Reg S-P notification requirements: how do you document a no-notice decision?

When an incident touches customer data, a chief compliance officer has 30 days from awareness to either notify affected customers or document why notice is not required. Under the Reg S-P notification requirements, the second path is narrow, and the file behind it is what an examiner will read.

What is the substantial harm determination under Reg S-P?

The substantial harm determination is the only exception to the Reg S-P notification requirements. Under 17 CFR 248.30(a)(4), a covered institution must notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice is not required if the firm determines, after a reasonable investigation of the facts and circumstances, that the information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

The SEC called this structure a presumption of notification in its 2024 adopting release. Notice is the default, and the firm carries the burden of showing why it did not send one. Both compliance dates have passed (December 3, 2025 for larger entities and June 3, 2026 for smaller entities, according to the SEC's small entity compliance guide), so every SEC-registered adviser and broker-dealer now works under this standard.

What counts as sensitive customer information?

Sensitive customer information is any component of customer information whose compromise could create a reasonably likely risk of substantial harm or inconvenience to the person it identifies. The rule gives two families of examples. The first is information that can authenticate a person on its own, such as a Social Security number, driver's license or passport number, taxpayer identification number, or biometric record. The second is an identifier such as an account number, name or online username combined with information that enables access, such as an access code, answers to security questions, a partial Social Security number, or a date of birth.

The definition frames the question an examiner is likely to ask about any no-notice decision: which data elements were exposed, and why does the firm believe they will not be misused? A memo that says "no sensitive data was involved" without listing the data elements reviewed does not answer that question.

What makes a Reg S-P investigation reasonable?

Regulation S-P does not define a reasonable investigation, and the SEC's adopting release says it depends on the facts and circumstances of the incident. The release notes that an intentional intrusion by a threat actor may warrant a more extensive investigation than an employee's inadvertent access. It lists factors that bear on the analysis, including whether the incident was internal or external, how long the unauthorized access lasted, which accounts were compromised and at what privilege level, and whether data was copied, transferred or retrieved.

Two points in the release matter most to whoever signs off on a no-notice decision:

• An inconclusive investigation does not excuse notice. If the firm cannot establish that misuse is not reasonably likely, the presumption of notification stands.
• The determination can change. The release says firms should revisit a notification decision when they learn new relevant facts, and gives the example of discovering that an encryption key was compromised.

In practice, the facts come from logs: mailbox audit records, sign-in logs, file access records, endpoint detection data and firewall records. If those logs were never enabled, or were not kept long enough, the investigation may not be able to reach a conclusion. That makes log retention a decision with direct regulatory consequences, made months before any incident occurs.

What records does a no-notice decision require?

A no-notice decision requires written documentation of the investigation and the basis for the determination. For SEC-registered advisers, Rule 204-2(a)(25) requires written records of any investigation and determination made regarding whether notification is required, including the basis for the determination, any written documentation from the U.S. Attorney General related to a delay in notice, and a copy of any notice sent. These records are kept for at least five years, the first two in an appropriate office of the adviser.

For broker-dealers, Rule 17a-4(e)(14) requires the same documentation, kept for three years from the date the records were made. Dual-registered firms should confirm which retention period their written procedures apply to records that serve both entities.

A defensible file typically contains:

• A timeline showing when the firm became aware of the incident, when the investigation began and when the determination was made. The 30-day notice period in 248.30(a)(4)(iii) runs from awareness, so the timeline shows whether the decision was made inside that window.
• The scope: which systems, accounts and individuals were reviewed, and how they were identified.
• The data elements exposed, mapped against the rule's definition of sensitive customer information.
• The evidence reviewed, with log sources and date ranges.
• The reasoning that connects the facts to the conclusion that substantial harm or inconvenience is not reasonably likely.
• Who made the determination, who reviewed it, and the date of each step.
• Any notice received from a service provider and the provider's own findings.

What if the firm cannot tell whose information was accessed?

If a firm cannot tell whose information was accessed, the notice population usually grows. Under 248.30(a)(4)(ii), when a firm cannot identify which specific individuals' sensitive customer information was accessed or used without authorization, it must notify every individual whose sensitive customer information resides in the affected system, except those it reasonably determines were not affected.

A no-notice determination for some or all of those individuals depends on being able to show which records an intruder could reach. That requires knowing where sensitive customer information lives: which mailboxes, file shares, CRM records and cloud applications hold it. A firm without a current data map has little basis for excluding anyone.

How does a service provider incident change the analysis?

A service provider incident moves much of the evidence outside the firm, while the notice decision stays with the firm. Under 248.30(a)(5), a firm's policies must provide for oversight of service providers, including through due diligence and monitoring, designed so that a provider notifies the firm as soon as possible, and no later than 72 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains. The firm keeps responsibility for the customer notice decision.

To make a no-notice determination after a vendor incident, the firm needs the provider's investigation results along with the notice itself. A provider that sends a brief alert and then stops responding leaves the firm with an inconclusive investigation, which under the release does not excuse notice. Agreement terms covering log retention, cooperation with investigations and the timing of evidence production give the firm a way to obtain what it needs.

What should firms do this quarter?

Most of the work happens before an incident:

• Write the determination procedure into the incident response program required by 248.30(a)(3). Name who investigates, who decides, who reviews, and the template the decision is recorded on.
• Compare log retention with the investigation you would need to run. Confirm that mailbox auditing, sign-in logs and file access logs are enabled, and how far back each one reaches.
• Build or update a data map showing which systems hold sensitive customer information.
• Run one tabletop scenario that ends in a no-notice determination and check whether the resulting file meets the list above inside the 30-day window.
• Confirm that service provider agreements address evidence sharing in addition to the 72-hour notice.
• Set retention for determination files: at least five years for adviser records and three years from creation for broker-dealer records.

This article describes what the rule requires. Whether a specific incident supports a no-notice determination is a question for the firm's compliance counsel.

How does s90 help?

s90 manages IT and security for RIAs, broker-dealers and dual-registered firms in Los Angeles and Orange County. Our client agreements include a 72-hour breach notification commitment and a 24-hour evidence production commitment, so a CCO working through a determination has a defined path to the log data the investigation depends on. If you would like to check whether your current logging could support a no-notice decision, we are glad to walk through it with you.