Reg S-P recordkeeping under Rule 204-2: which records must you keep, and for how long?

Which Reg S-P records does Rule 204-2 require advisers to keep?

Rule 204-2(a)(25) requires SEC-registered advisers to keep written records of the Reg S-P program itself, of every detected incident, of every notice decision, and of service provider oversight. The SEC's fact sheet summarizes the change: covered institutions other than funding portals must make and maintain written records documenting compliance with the safeguards rule and the disposal rule.

Rule 204-2 is the Advisers Act books and records rule. The 2024 amendments added Rule 204-2(a)(25), which spells out six categories:

• The written policies and procedures for safeguarding customer information under 17 CFR 248.30(a).
• Written documentation of any detected unauthorized access to or use of customer information, and of the response and recovery.
• Written documentation of any investigation and determination about whether customer notice is required, including the basis for the determination, any written request from the U.S. Attorney General to delay notice, and a copy of any notice sent.
• The written policies and procedures for overseeing service providers.
• Written documentation of each contract or agreement with a service provider under that oversight requirement.
• The written policies and procedures for disposing of consumer report information.

Broker-dealers keep parallel records under Rule 17a-4(e)(14). The categories match closely; the retention clock works differently, as the next section shows.

How long must Reg S-P records be kept?

Advisers keep them at least five years; broker-dealers keep most items three years from a trigger date. Under Rule 204-2(e)(1), an adviser keeps records for at least five years from the end of the fiscal year of the last entry, the first two years in an appropriate office of the adviser.

Under Rule 17a-4(e)(14), a broker-dealer keeps its Reg S-P policies and procedures until three years after the firm stops using them, incident and notification documentation for three years from creation, and service provider contracts until three years after the contract ends, all in an easily accessible place. A policy retired in 2027 can therefore still be requested in 2030.

What counts as documentation of a detected incident?

It is a written record of what happened, what customer information was involved, and how the firm responded and recovered. The rule does not prescribe a format, so a well-kept ticket can serve if it captures the facts. A useful incident record includes:

• Date and time of detection, and how the event was detected (alert, user report, vendor notice).
• Systems and accounts affected, and whether customer information was stored in them.
• Containment steps, such as password resets, session revocation, or isolating a device.
• Recovery steps and the date normal operations resumed.
• Who handled each step, and when the incident was closed.

Many small incidents, such as a phished mailbox caught within minutes, never reach a notice decision. They still belong in the record if customer information was in scope, because the rule's documentation duty attaches to detected unauthorized access, whatever its size.

How should you document a decision not to notify customers?

Write down the investigation, the evidence reviewed, and the reasoning, then keep it with the incident record. Under 17 CFR 248.30(a)(4), notice to affected individuals is due as soon as practicable and no later than 30 days after the firm becomes aware of unauthorized access to sensitive customer information. A firm may skip notice only if a reasonable investigation finds the information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

Rule 204-2(a)(25) requires advisers to keep documentation of that investigation and the basis for the determination. A defensible file usually shows what data was exposed and whose, the log evidence reviewed, whether the data was encrypted, who made the call, and the date. The SEC's adopting release also says that if encryption protecting the data is later compromised, a firm generally should revisit its determination.

What service provider records will examiners expect?

Examiners will expect the oversight procedures and any contracts or agreements with providers. 17 CFR 248.30(a)(5) requires policies and procedures for due diligence and monitoring of service providers, designed so that each provider protects customer information and notifies the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach affecting a customer information system it maintains.

In practice the file for each vendor with access to customer information holds the due diligence performed at onboarding, any contract or agreement (including terms supporting the 72-hour notice), and evidence of ongoing monitoring, such as reviewed security reports or questionnaire responses. The list is often longer than expected. Custodian portals, CRM, financial planning software, e-signature, document storage, and the IT provider itself can each qualify. For more on the notice term, see the Reg S-P service provider 72-hour notice.

Where should the records live, and who owns them?

Keep them in one place, organized to match the rule, with a named owner for each category. Rule 204-2(g) permits advisers to keep required records electronically, subject to its conditions. The practical test is speed: at the SEC's January 2026 outreach event for small firms, staff covered the expected maintenance and production of books and records and walked attendees through a sample document request list.

Ownership matters as much as storage. The SEC's September 2026 risk alert on annual compliance reviews found advisers that created review records and then failed to keep them. Reg S-P records split across compliance, operations, and IT invite the same problem. Assign compliance to own the policies and determinations, and assign IT or your managed service provider to own incident logs and vendor monitoring evidence, with compliance reviewing both.

What should you do this quarter?

Build the evidence folder now and test it with a mock request, using what SEC examiners are asking for as a guide. A short checklist:

• Create a Reg S-P records index with one line for each Rule 204-2(a)(25) or Rule 17a-4(e)(14) item, its location, and its owner.
• Pull every security event since your compliance date and confirm each has a written record.
• For each event involving sensitive customer information, confirm the notice decision and its basis are documented.
• List every service provider with access to customer information and confirm due diligence, monitoring evidence, and any contract or agreement are on file.
• Confirm retired policies are archived with their retirement date, so the retention clock is clear.
• Ask a colleague outside compliance to retrieve five random items in under an hour. Fix whatever slows them down.

How can s90 help?

s90 keeps the IT side of the Reg S-P record current as part of our monthly reporting for financial services clients: incident logs, access reviews, vendor monitoring evidence, and disposal records. Our agreements include a 24-hour evidence production commitment and 72-hour breach notification, so the records an examiner asks for are ready when you need them. If you would like help building your records index, we are happy to start with a short review.