Reg S-P compliance six months in: what are SEC examiners asking for?

What are SEC examiners asking for now that Reg S-P compliance dates have passed?

They are asking firms to show that their Regulation S-P compliance program exists, operates, and leaves records behind. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, according to the SEC's small entity compliance guide. The Division of Examinations said in its fiscal year 2026 priorities that after the applicable compliance dates it would examine whether firms have developed, implemented, and maintained policies and procedures under the amended rule. Before those dates, it said examiners would ask firms about their progress in preparing incident response programs.

For advisers, the larger-entity line in the SEC's adopting release was $1.5 billion in assets under management, so most firms between $100 million and $1.5 billion had until June. By December, those firms have six months of live compliance behind them. That is long enough for an examiner to expect evidence that the program runs, in addition to the written policy.

What did the SEC tell small firms to expect in an exam?

The SEC told small firms to expect requests for policies, procedures, and books and records, plus questions about incident response. At its third and final Reg S-P compliance outreach event on January 22, 2026, staff from the Divisions of Examinations, Investment Management, and Trading and Markets walked through the examination lifecycle for firms subject to the rule, including the expected maintenance and production of policies, procedures, books and records.

The session closed with a workshop: an incident response tabletop discussion, a review of a sample document request list, and a mock examination session. The recording runs about 90 minutes. For a CCO preparing a first exam under the amended rule, it is the closest thing to a preview the SEC has published.

What is in the SEC's Reg S-P sweep request letters?

Reported request letters reach well past the privacy notice. In an August 18, 2026 client alert, the law firm Foley Hoag described document request letters to registered advisers that appear to be a Reg S-P sweep. The SEC has not released the letter, so treat this list as secondhand. According to the alert, the requests cover:

• Governance: organization charts, cybersecurity reporting lines, committee structures, IT governance, and risk assessment documentation.
• The compliance program: Rule 206(4)-7 policies, the most recent annual compliance review, and compliance testing.
• Privacy and information security: privacy notices with proof of delivery, safeguards, complaints, and incident response materials.
• Incidents during the review period, including any client harm and remediation.
• Service providers: vendor policies, risk assessments, agreements, monitoring records, and a complete vendor list.
• Personnel, outside consultants, and client account and AUM data.

Most of these items are technology evidence. A CCO can describe the program, but the vendor list, the risk register, and the incident log usually come from IT. Our guide to Reg S-P recordkeeping under Rule 204-2 lists each required record and how long to keep it.

Where do firms most often come up short?

The most common gap is a program that works in practice with little written record behind it. The SEC's September 14, 2026 risk alert on adviser annual compliance reviews describes the pattern: reviews skipped or run more than 12 months apart, reviews that did not follow their own written scope, records created and then not kept, and recommended fixes that never happened.

That alert covers the annual review in general, and the same pattern shows up in Reg S-P programs. The amended rule added specific documentation duties. An SEC-registered adviser must keep, under Rule 204-2(a)(25), written documentation of any detected unauthorized access to customer information and the response to it, documentation of any investigation into whether customer notice was required and the basis for the decision, and documentation of service provider contracts. Broker-dealers keep parallel records under Rule 17a-4(e)(14).

A firm that contained a compromised mailbox quickly and wrote nothing down has a gap. Under 17 CFR 248.30(a)(4), a firm may skip customer notice only after a reasonable investigation finds that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. An examiner can ask to see that investigation.

Which technology evidence answers these requests fastest?

Evidence that systems produce on their own answers requests faster than a narrative written after the fact. Aim to be able to pull each of these within a day:

• A current inventory of systems that store or process customer information, including cloud and vendor-hosted applications.
• Multifactor authentication enforcement reports and periodic access reviews, with terminated users removed.
• An incident and ticket log showing how each event was detected, escalated, investigated, and closed.
• Tabletop exercise results with action items, owners, and completion dates.
• A vendor list with risk ratings, due diligence files, monitoring evidence, and the contract terms that support the 72-hour breach notice expected under 17 CFR 248.30(a)(5).
• Security awareness training completion records and phishing simulation results.
• Disposal records for retired laptops, drives, and copiers.

What should you do this quarter?

Run your own exam before the SEC does. A practical sequence for the next 90 days:

• Watch the January 2026 outreach recording with your CCO and run a mock request against your own records.
• Build one Reg S-P evidence folder, organized to match Rule 204-2(a)(25) or Rule 17a-4(e)(14), and name an owner for each item.
• Review every security event since your compliance date and confirm each has a written record, including any decision not to notify.
• Confirm every service provider with access to customer information has documented due diligence, ongoing monitoring, and contract terms that support 72-hour breach notice.
• Add Reg S-P testing to the annual compliance review, write up the results, and keep the write-up.
• When the Division publishes its fiscal year 2027 priorities, compare its Reg S-P language against this list. Until then, see what the 2026 priorities signal for FY2027.

How can s90 help?

s90 runs IT for advisers and broker-dealers with exam evidence built into the monthly reporting, so the vendor list, access reviews, and incident log are current when a request letter arrives. Our agreements commit to 72-hour breach notification and 24-hour evidence production, which fits the service provider expectations in the amended rule. If you would like a second set of eyes on your Reg S-P evidence before your next exam, we are glad to walk through it with you.