Reg S-P for dual registrants: can one program cover the broker-dealer and the RIA?

If your firm is a dual registrant, registered as both a broker-dealer and an investment adviser, examiners will look at how your Reg S-P program covers each side of the business. When the two sides keep separate policies for the same systems, the gaps tend to surface during an exam or in the middle of an incident. This article covers what the rule requires of each registration and how to run one program that satisfies both.

Does Reg S-P apply differently to the broker-dealer and the RIA?

No. Rule 248.30 sets the same core requirements for every covered institution, and both sides of a dual-registered firm are covered institutions. Each owes written safeguards policies, an incident response program, customer notice, service provider oversight and disposal procedures.

Two commenters on the amendments raised dual registrants, and the SEC addressed them in a footnote of the adopting release (89 FR 47690, note 16). One commenter noted that the requirements apply uniformly to broker-dealers and advisers. The SEC's response was that each covered institution, including a dual registrant, has to tailor its policies and procedures to its business. A dual-registered firm's business includes brokerage and advisory accounts, often for the same households, so the program has to fit both.

The compliance dates have passed for every firm: December 3, 2025 for larger entities and June 3, 2026 for smaller entities, according to the SEC's small entity compliance guide. The question an examiner asks now is whether the program works across both registrations.

Can dual registrants use one set of Reg S-P policies for both registrations?

Yes, if the policies meet the requirements of each rule they are meant to satisfy. The adopting release states that a covered institution can adopt a single set of policies and procedures covering Regulation S-P and other rules, provided the policies meet the requirements of each rule.

For most dual-registered firms, one program is the practical choice. The data, systems and people overlap: one CRM, one email platform, one document store, and often the same representatives acting in both capacities. Two programs written for the same systems tend to drift apart over time, and an examiner comparing them will see the gaps.

A single program should still show both registrations clearly. Useful ways to do that:

• A scope statement naming the broker-dealer and investment adviser registrations, and every affiliated entity the program does or does not cover.
• A data map that tags brokerage, advisory and shared repositories, so the incident team knows whose information sits where.
• A cross-reference table tying each policy section to 17 CFR 248.30 and to the broker-dealer and adviser recordkeeping rules.
• A named owner for each element, with one person accountable for the whole program.

What if the broker-dealer and RIA are separate affiliated companies?

Each registered entity is its own covered institution with its own obligations. Affiliates can share a policy framework, staff and systems, but each entity's program has to meet the rule for that entity, and each entity needs its own records.

Shared services raise a scoping question. Under 17 CFR 248.30, a service provider is any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through its provision of services directly to a covered institution. When one affiliate runs IT, operations or client service for another, ask counsel whether that affiliate fits the definition. If it does, document due diligence, monitoring and the 72-hour breach notice term the same way you would for an outside vendor.

How do the recordkeeping rules differ between the two sides?

The record categories largely match, and the retention periods differ. Advisers keep Reg S-P records under Rule 204-2(a)(25) for at least five years from the end of the fiscal year of the last entry, the first two years in an appropriate office. Broker-dealers keep them under Rule 17a-4(e)(14): policies until three years after the firm stops using them, incident and notification documentation for three years from creation, and service provider contracts until three years after the contract ends.

A dual-registered firm that keeps one set of records can apply the longer period wherever a record serves both registrations. That is simpler to run, and it avoids disposing of a record under the broker-dealer schedule while the adviser rule still requires it. Confirm the approach with counsel and write it into the records policy. Our guide to Reg S-P recordkeeping under Rule 204-2 covers the adviser side in more detail.

How should incident response and customer notice work across both registrations?

Run one investigation and make one documented notice decision that covers every affected customer, whatever the account type. Under 17 CFR 248.30(a)(4), notice is due as soon as practicable and no later than 30 days after the firm becomes aware that unauthorized access to or use of sensitive customer information has occurred or is reasonably likely to have occurred. Notice is not required only if a reasonable investigation finds the information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

The hard parts for a dual-registered firm are practical. A household may hold both brokerage and advisory accounts, and two notices with different facts about one event erode client trust. Settle these points in the response plan before an incident:

• Who makes the notice determination, and who signs off for each registration.
• How the incident team identifies whether affected individuals are brokerage customers, advisory clients or both.
• One notice template that meets the rule's content requirements for both sides.
• Where the investigation file is stored, so it satisfies both the Rule 17a-4 and Rule 204-2 record requirements.

The amendments let a firm agree in writing for a service provider to notify affected individuals on its behalf. The SEC's compliance guide is clear that ultimate responsibility for the notice stays with the firm. Separately, every service provider with access to customer information must be required to notify the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach. Our article on updating vendor contracts for the 72-hour notice walks through the contract terms to check.

How does Reg S-P fit with FINRA rules and the annual compliance review?

Reg S-P testing can feed both the broker-dealer's FINRA obligations and the adviser's annual compliance review, because they cover the same systems. FINRA Rule 3110 supervision, the Rule 3130 annual CEO certification and the Rule 4370 business continuity plan all touch the systems Reg S-P protects. On the advisory side, Advisers Act Rule 206(4)-7 requires a review, at least annually, of the adequacy of the firm's compliance policies and procedures.

Aligning these calendars lets one round of Reg S-P testing feed the Rule 206(4)-7 review and the Rule 3130 certification process. The firm tests each control once and keeps one set of evidence that both sides can point to. For what that evidence looks like on the broker-dealer side, see the technology evidence behind the Rule 3130 certification.

What should a dual-registered firm do this quarter?

Confirm the program reflects both registrations in writing, then test it against a realistic incident. A short list:

• Check that the scope statement names both registrations and every affiliate the program covers.
• Reconcile the service provider inventory across both sides, including any affiliate that provides shared services.
• Set retention for shared records to the longer applicable period, with counsel's sign-off.
• Run a tabletop exercise where a compromised mailbox exposes data on clients who hold both account types, and time how long it takes to identify who must be notified.
• Align the Reg S-P annual review with the Rule 206(4)-7 review and the Rule 3130 certification cycle.

How can s90 help?

s90 supports dual-registered firms and affiliated broker-dealer and RIA groups with one IT control set mapped to both registrations. Our monthly reporting produces the incident logs, access reviews and vendor monitoring evidence both sides need, and our agreements include 72-hour breach notification and 24-hour evidence production. If you would like a second look at how your program covers both registrations, we are glad to start with a short review.