Reg S-P service provider notice: are your vendor contracts updated?

What does Reg S-P require of service providers?

Reg S-P requires your firm to oversee its service providers. Amended Rule 248.30(a)(5) requires written policies and procedures reasonably designed to require oversight of service providers, including through due diligence and monitoring. That oversight must be designed so service providers take appropriate measures to protect against unauthorized access to or use of customer information, and notify the firm as soon as possible, but no later than 72 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system the provider maintains.

Once that notice arrives, the firm's own incident response program under paragraph (a)(3) starts. Under paragraph (a)(5)(iii), the obligation to make sure affected individuals are notified stays with the firm, even when a vendor is involved.

That makes vendor notice terms part of the same program you test each year. For the firm's side of the process, see how to run the first annual review of your Reg S-P incident response program.

Both compliance dates for the Regulation S-P amendments have passed. The SEC's small entity compliance guide sets December 3, 2025 for larger entities and June 3, 2026 for smaller entities.

Does the rule require a written contract with every vendor?

No. The final rule requires policies and procedures and leaves the method to the firm. The SEC's 2023 proposal would have required these protections "pursuant to a written contract between the covered institution and its service providers," with a 48-hour notice window. The adopted rule has no contract mandate and sets the window at 72 hours.

In practice, a contract or written amendment is still the most direct way to show an examiner that a vendor agreed to notify within 72 hours. A policy that says vendors must notify the firm within 72 hours, with no evidence any vendor agreed, is hard to defend. The rule does describe one specific written agreement: under paragraph (a)(5)(ii), a firm may agree in writing for a service provider to notify affected individuals on its behalf.

Which vendors count as service providers?

Any vendor that receives, maintains, processes or is otherwise permitted access to customer information through services it provides directly to your firm is a service provider under paragraph (d)(10). That covers more vendors than most firms expect.

For an RIA or broker-dealer, the list often includes:

• The managed IT provider, plus any security monitoring, backup or help desk vendor.
• CRM, portfolio management, financial planning and performance reporting platforms.
• Email archiving, e-signature, document storage, client portal and file transfer tools.
• Outsourced compliance, bookkeeping or payroll firms with access to client files.
• AI tools that process client meeting notes, documents or email.

Whether a specific relationship meets the definition is a judgment for the firm and its counsel. Starting broad and narrowing with a documented reason is easier to defend than starting narrow. Custodians and clearing firms deserve a specific note in that analysis, because they often hold their own relationship with your clients as well as providing services to your firm.

When does a vendor's 72-hour clock start?

A vendor's 72-hour clock starts when it becomes aware of a breach in security resulting in unauthorized access to a customer information system it maintains. The trigger is awareness of the breach. The clock does not wait for a completed forensic review or for confirmation that customer data was taken.

That trigger is the first thing to compare against existing contract language. Common gaps:

• Notice tied to a "confirmed" incident or to completed forensic findings, which can take weeks.
• Notice "without unreasonable delay" or "promptly," with no outer limit.
• Notice limited to breaches of "your data" rather than of the system the vendor maintains.
• Notice sent to a generic support address or an account manager rather than a named firm contact.
• A notice clause in a master agreement signed before 2024 and never amended.

What records will an examiner expect?

Examiners will expect the service provider policies, the vendor agreements and evidence that oversight happened. For SEC-registered advisers, Rule 204-2(a)(25) requires keeping the written service provider policies and procedures adopted under Rule 248.30(a)(5)(i) and the written documentation of any contract or agreement entered into under Rule 248.30(a)(5). Rule 204-2(e)(1) sets a five-year retention period. Broker-dealers follow Rule 17a-4(e)(14).

The SEC Division of Examinations' fiscal 2026 priorities list oversight of third-party vendors among the areas Regulation S-P examinations will cover. A reasonable working assumption is a request for the vendor inventory, due diligence files, and the notice terms for key providers.

What should you do this quarter?

This quarter, close the gap between your vendor policy and the vendor paperwork:

• Build or refresh the vendor inventory, marking every vendor with access to customer information.
• Pull the current agreement for each one and record whether it has a breach notice clause, its timing, its trigger and its contact.
• Send an amendment or side letter where the clause is missing or weaker than 72 hours. Keep the signed copy, or the vendor's written response.
• Where a vendor will not amend, document the steps you took instead, such as written confirmation of its incident notice process and closer monitoring, and escalate the decision to whoever owns your Reg S-P program.
• Add 72-hour notice terms to new-vendor due diligence so the gap does not reopen.
• Put a named contact and an after-hours route in each notice clause, and confirm the address works.
• Decide whether any vendor will notify customers for you. If so, put it in a written agreement under paragraph (a)(5)(ii).

How does s90 help?

s90's client agreements include a 72-hour breach notification commitment and a 24-hour evidence production commitment, so one key technology vendor is already covered. We also help RIAs, broker-dealers and dual-registered firms inventory the rest of their technology vendors, collect notice terms, and keep the records organized for an exam. If your vendor file needs work, a short call is a good place to start.