SEC Regulation S-P

No SEC rule names specific tools, but Regulation S-P requires written safeguards for customer information and oversight of service providers. A personal account gives the firm no contract, admin console, audit log or retention control, which makes that oversight hard to show. Most firms approve a firm-managed business plan and block personal AI accounts on firm devices.

Retention is how long a vendor keeps your prompts, files and outputs before it deletes them. Training is whether the vendor uses that content to build or improve its models. They are separate terms in separate clauses, so a vendor can keep data without training on it. Get a written answer to each one for the vendor file.

The letter sent to the client, yes. Rule 204-2(a)(7) requires SEC-registered advisers to keep written communications sent relating to recommendations or advice, generally for five years. Whether the AI prompts and intermediate drafts must also be kept is a decision firms should make with counsel and write into their policies, then configure retention to match.

Possibly, depending on the elements. Civil Code section 1798.82 lists a name combined with a financial account number and any required access code or password. Names with Social Security numbers clearly qualify. For SEC-registered firms, Regulation S-P's broader definition of sensitive customer information may require notice even when California's list does not.

Only if it applies firm-wide and covers every path the data can take. Check whether an administrator or each user sets the opt-out, whether rating a response or sending feedback creates an exception, whether free or personal accounts follow different terms, and whether a third-party model provider behind the tool has its own training terms. Get unclear points answered by the vendor in writing.

They should state how long prompts, outputs, uploaded files and transcripts are kept, whether a separate period applies to abuse or safety monitoring, and whether an administrator can shorten it. They should also cover what happens to firm data when a user is removed or the contract ends, how long deletion from backups takes, and whether the vendor will confirm deletion in writing.

No. Under amended Regulation S-P, notice depends on whether sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. It is due within 30 days unless a reasonable investigation finds no reasonable likelihood of use that would cause substantial harm or inconvenience. A deletion confirmation is evidence for that investigation, and waiting for one does not pause the clock.

It can be. Regulation S-P defines a service provider as any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through services provided directly to the firm. If advisers put customer information into a firm-contracted AI tool, the vendor likely fits, and the firm's due diligence, monitoring and 72-hour breach notice requirements apply. Confirm the analysis with counsel.

No rule prescribes a format. A practical inventory lists each vendor and the platform it connects to, the customer data in scope, the permission level (read only, trading or money movement), the credential type and last rotation date, the internal owner, the vendor's breach notification commitment, and the date and evidence of the last due diligence review.

From a compliance view, the best AI tool is the one the firm controls. ChatGPT Business or Enterprise and Claude for Work come with business terms that the vendors say exclude training on customer data by default, plus admin settings and single sign-on on qualifying plans. Pick one platform, connect it to your identity provider, block personal accounts, and keep the vendor file current.

Yes. OpenAI supports a ChatGPT-Allowed-Workspace-Id header that a TLS-inspecting proxy or security service adds to chatgpt.com traffic. Only the listed Enterprise workspaces remain usable, and personal workspaces are filtered out. Logged-out use needs a separate URL block, and the desktop and mobile apps need certificate handling or a block.

Often, yes. Amended Regulation S-P defines a service provider as any person or entity that receives, maintains, processes or is otherwise permitted access to customer information through services provided directly to the firm. A CRM, rebalancer, billing or aggregation platform pulling custodian data on your behalf generally fits. Whether a specific arrangement qualifies is a question for compliance counsel.

Not immediately. OpenAI says a deleted chat disappears from the account at once and is scheduled for permanent deletion from its systems within 30 days, unless it was already de-identified or OpenAI must keep it longer for security or legal reasons. Capture a record of what was pasted before deleting, and note the retention window in your incident file.

Often not. Microsoft Purview's built-in U.S. bank account number type matches 6 to 17 digits only when a keyword such as checking, savings or bank account appears within 300 characters. Prompts that refer to a custodial or brokerage account may not include those words. Firms usually need a custom sensitive information type built around their custodians' account formats and the terms staff actually use.

Regulation S-P does not name multifactor authentication. It requires written policies and procedures covering administrative, technical and physical safeguards for customer information, and the SEC's fiscal 2026 exam priorities name access controls and account management. State-registered advisers under the FTC Safeguards Rule must use MFA for anyone accessing any information system unless the Qualified Individual approves an equivalent control in writing.

Yes. In its 2024 Reg S-P adopting release, the SEC said a covered institution can adopt a single set of policies and procedures covering Regulation S-P and other rules, provided they meet the requirements of each rule. A dual-registered firm still has to tailor the program to both its brokerage and advisory business, and keep records under both the broker-dealer and adviser recordkeeping rules.

Yes. FINRA Regulatory Notice 24-09 says its rules apply when firms use generative AI through third-party technology, including features embedded in existing products. Under Regulation S-P, a vendor whose AI feature receives customer information is likely a service provider. Review the terms for the new feature before staff use it with client data.

No GLBA rule names a specific algorithm. The FTC Safeguards Rule requires encryption consistent with current cryptographic standards and safeguards for key material. For data in transit, NIST SP 800-52 Rev. 2 calls for TLS 1.2 with FIPS-based cipher suites and support for TLS 1.3. For data at rest, most firms use AES, the NIST standard in FIPS 197, through tools such as BitLocker and FileVault.

No. The FTC Safeguards Rule treats customer information as unencrypted if the encryption key was accessed by an unauthorized person. In its 2024 Reg S-P adopting release, the SEC said a firm relying on encryption to decide notice is not required should revisit that decision if the decryption key was also obtained. Protecting and escrowing keys is part of the control.

Often it is only the starting point. NIST SP 800-88 Rev. 2 notes that phones can hold on-board and removable memory, so each component may need its own approach. Wipe the device through your management platform, remove and handle any memory card, release it from firm accounts, and record what was done.

A family office that meets the SEC's family office rule is excluded from the definition of investment adviser, so Regulation S-P does not reach it as an adviser. Reg S-P covers registered advisers, broker-dealers, investment companies and registered transfer agents. If the family also works with a registered adviser or broker-dealer, those firms carry their own Reg S-P duties. Counsel should confirm the office's status.

Not directly. A vendor's privacy request process is tied to the account holder, so the employee has to delete the conversations and submit the request, for example through privacy.openai.com for OpenAI. The firm can require this under its policies, supervise the steps, and keep screenshots, the request and the vendor's reply in the incident file.

Neither the FTC Safeguards Rule nor Regulation S-P sets a fixed schedule. The FTC rule requires periodic assessment based on the risk a provider presents, and Reg S-P requires oversight through due diligence and monitoring. Many firms tier vendors by risk, review high-risk vendors at least annually and after major changes, and document the cadence in their written policy.

GLBA is the federal law. Regulation S-P is the SEC rule that implements GLBA's privacy and safeguards requirements for SEC-registered firms. For an SEC-registered RIA or broker-dealer, complying with Reg S-P is how you comply with GLBA.

Three or four. Microsoft says effectiveness is noticeably reduced when users have more than five main labels. A common set for advisers and broker-dealers is Public, Internal, Client Confidential and Client Restricted, with encryption reserved for the restricted label that covers ID copies, account applications and other sensitive customer information.

Regulation S-P does not set a frequency. It requires written procedures for overseeing service providers, including due diligence and monitoring, and Rule 206(4)-7 requires an SEC-registered adviser to review its policies at least annually. A practical cadence is to review integrations during that annual review, at each contract renewal, and whenever a vendor changes its product or the internal owner leaves the firm.

Regulation S-P does not set a frequency. Running one at least once a year lets the results feed the annual compliance review. A second exercise after a significant change, such as a new custodian, CRM or IT provider, tests the notice procedure where it changed.

No. CSF 2.0 is a voluntary set of outcomes, and compliance is measured against each rule's own text. A crosswalk shows where one control or document can serve as evidence for several rules. It does not cover requirements that exist only in a rule, such as the 30-day customer notice in Reg S-P or annual board reporting under the FTC Safeguards Rule.

Leave out Social Security numbers, full account numbers, dates of birth and anything used to verify identity, which Reg S-P treats as sensitive customer information. Use names, holdings and balances only in a firm-approved tool. A simple habit is to draft with placeholders and fill in figures from the reporting system after the AI writes the narrative.

Rule 204-2(a)(25) lists six: written safeguards policies and procedures, documentation of detected unauthorized access and the response, documentation of notice investigations and determinations, service provider oversight policies, service provider contracts, and disposal policies for consumer report information. They are kept at least five years.

The rule does not mention exceptions. 17 CFR 248.30(a)(1) requires written policies covering administrative, technical and physical safeguards, so any control the firm does not apply is a departure from its own policy. Firms document those departures with a reason, compensating controls, an approver and an expiry date, and keep them with their Reg S-P records.

No. 17 CFR 248.30 requires written policies and procedures to safeguard customer information, including an incident response program, but its text does not require a report to a board or name an approver. Advisers still review their compliance policies at least annually under Advisers Act Rule 206(4)-7, and the report behind a broker-dealer CEO's FINRA Rule 3130 certification goes to the board.

Under 17 CFR 248.30(a)(5), a broker-dealer's incident response program must include policies and procedures requiring oversight of service providers, including due diligence and monitoring. Providers must protect customer information and notify the firm no later than 72 hours after becoming aware of a breach affecting a customer information system they maintain. The firm keeps the obligation to ensure customers are notified.

No rule text names a certificate. 17 CFR 248.30(b) requires reasonable disposal measures and written disposal policies, and the 2024 amendments require records documenting compliance. A per-device certificate that lists the serial number, sanitization method, tool, verification method and the person who did the work is the simplest evidence that a specific device was handled under the procedure.

As soon as practicable, but not later than 30 days after the firm becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. Notice is not required if a reasonable investigation shows the sensitive customer information is not reasonably likely to be used in a way that causes substantial harm or inconvenience.

Under 17 CFR 248.30(a)(4)(iv), the notice must describe the incident and the type of sensitive customer information involved in general terms, give the date or date range if known, provide contact information for the firm, recommend reviewing account statements, explain fraud alerts, recommend obtaining credit reports and how to get them free, and point to the FTC's identity theft resources.

Yes. Under 17 CFR 248.30(d)(5), customer information is any record containing nonpublic personal information about a customer, whether in paper, electronic or other form, handled or maintained by the firm or on its behalf. Include file rooms, offsite storage boxes and printed reports in the map alongside email, cloud storage and vendor platforms.

Not by that name. Under 17 CFR 248.30(a)(3)(i), a firm's incident response program must include procedures to identify the customer information systems and types of customer information that may have been accessed in an incident. A current inventory of systems and the data they hold is the practical way to meet that requirement within the 30-day customer notice window.

Yes. Under 17 CFR 248.30(d), customer information means any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic or other form. Shredding paper client files and sanitizing devices should both be covered by the same written disposal procedure.

Yes. A firm may skip customer notice only after a reasonable investigation finds no reasonable likelihood of substantial harm or inconvenience. SEC-registered advisers must keep written documentation of that investigation and the basis for the determination under Rule 204-2(a)(25), and broker-dealers keep the same documentation under Rule 17a-4(e)(14).

No. Regulation S-P is an SEC rule, codified at 17 CFR Part 248. FINRA has published a cybersecurity advisory on the 2024 amendments noting that they apply to broker-dealers, including funding portals, and recommending that member firms review them. For a dual-registered firm, the same SEC rule governs both the brokerage and advisory sides.

Regulation S-P applies to the SEC-registered adviser as a firm, and the firm's policies have to govern how its people, including investment adviser representatives, access and handle customer information. At a dual-registered firm, a representative who is both a registered rep and an IAR should follow one set of access, email and incident reporting procedures.

It can. Many copiers store images of scanned and copied pages on an internal drive, and if those pages include customer information, returning the copier is a disposal event under 17 CFR 248.30(b). The FTC's copier guidance suggests lease terms that let the firm keep the drive or require the provider to overwrite it, handled by skilled technicians.

Usually, yes. Rule 248.30(d)(10) defines a service provider as any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through services provided directly to a covered institution. A managed IT provider with administrative access to email, endpoints, file storage or backups is permitted access, so the firm's written oversight policies under Rule 248.30(a)(5) should cover it.

Generally the firm where the incident occurred. The SEC's 2024 adopting release explains that the institution with the incident has the facts needed to inform affected individuals. A firm without contact details can coordinate with the institution that holds the customer relationship, and the two firms can agree which of them sends the notice. The 30-day deadline still applies.

Yes. Since the 2024 amendments, 17 CFR 248.30(d)(5) defines customer information to include nonpublic personal information about customers of other financial institutions that has been provided to your firm. Your safeguards policy, incident response program, service provider oversight and disposal procedures all need to cover those records, not only data about your own clients.

It can. Reg S-P's incident response program covers any unauthorized access to or use of customer information, including information given out over the phone. If sensitive customer information was, or is reasonably likely to have been, accessed without authorization, notice is due within 30 days of becoming aware, unless a reasonable investigation shows it is not reasonably likely to be used to cause substantial harm or inconvenience.

Investment advisers keep Regulation S-P records under Rule 204-2(a)(25) for five years, the first two in an appropriate office. Broker-dealers follow Rule 17a-4(e)(14): policies until three years after they stop being used, incident and notification documentation for three years from creation, and service provider contracts until three years after the contract ends.

No. Regulation S-P does not name a technology. Amended Rule 248.30(a) requires written policies and procedures reasonably designed to protect against unauthorized access to customer information, and an incident response program that can identify which systems and types of customer information were accessed. Zero trust network access is one way to meet those objectives and to produce the access logs an investigation needs.

Yes. In its 2024 adopting release, the SEC said covered institutions should revisit a notification determination when they learn new relevant facts, giving the example of a compromised encryption key. The release also says an inconclusive investigation does not excuse notice, so new facts that undercut the original reasoning can bring the notice requirement back.

It is any component of customer information whose compromise could create a reasonably likely risk of substantial harm or inconvenience. The rule's examples include Social Security, driver's license, passport and taxpayer identification numbers, biometric records, and account numbers or user names combined with authenticating details such as an access code, security question, partial Social Security number or date of birth.

Amended Rule 248.30(a)(5) requires a covered institution's policies to be reasonably designed so that service providers notify it as soon as possible, but no later than 72 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system the provider maintains. The firm itself remains responsible for making sure affected individuals are notified.

Yes, if the firm enters into a written agreement for it. Rule 248.30(a)(5)(ii) allows a covered institution to have a service provider notify affected individuals on its behalf. Under Rule 248.30(a)(5)(iii), the obligation to ensure affected individuals are notified stays with the firm, so it should still confirm that notices went out on time and with the required contents.

Rule 248.30 defines covered institutions to include brokers or dealers, investment companies, and investment advisers and transfer agents registered with the Commission. An adviser registered only with a state is not registered with the SEC, so it falls outside that definition. State-registered advisers should confirm with counsel which state privacy and security rules apply to them.

No. Amended Regulation S-P requires a written incident response program reasonably designed to detect, respond to and recover from unauthorized access to customer information, including customer notification procedures. It does not prescribe how the program is tested. Many firms use a tabletop exercise to check whether the notice procedure can meet the 30-day deadline and keep the exercise report as evidence.

It means the firm's incident response program includes written policies and procedures reasonably designed to require oversight of service providers, including through due diligence and monitoring. Under Rule 248.30(a)(5)(i), those policies must be designed so each provider protects against unauthorized access to customer information and notifies the firm no later than 72 hours after becoming aware of a breach of a customer information system it maintains.

Under 17 CFR 248.30(a)(4)(ii), a firm that cannot identify which individuals' sensitive customer information was accessed or used without authorization must notify every individual whose sensitive customer information resides in the affected system, except those it reasonably determines were not affected. A current data map is what lets a firm narrow that group.

Not by name. Rule 248.30 requires written safeguards reasonably designed to protect against anticipated threats or hazards to customer information. Software that no longer receives security updates is a widely known risk, so examiners reviewing a firm's safeguards may ask how unsupported systems fit within its written policies. Your compliance counsel can advise on your firm's specific facts.

The amended rule applies to covered institutions: broker-dealers, funding portals, investment companies, investment advisers registered with the SEC, and transfer agents registered with the SEC or another appropriate regulator. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, according to the SEC's small entity compliance guide.

No. Amended Rule 248.30(a)(5) requires written policies and procedures for overseeing service providers, including due diligence and monitoring. The 2023 proposal would have required a written contract, and the final rule did not adopt that mandate. Many firms still use contract terms to evidence the 72-hour notice commitment, and Rule 204-2(a)(25) requires advisers to keep any such agreements.

Start with the Regulation S-P records Rule 204-2(a)(25) already requires: written safeguards, incident response, service provider oversight and disposal policies, records of any detected unauthorized access and notification decisions, and service provider contracts. Buyers also commonly ask for a vendor inventory, MFA and user access reports, a device inventory, backup test results and a description of what the communications archive captures.

They must still be preserved for the full retention period. Under SEC Rule 204-2(f), an adviser that ceases business must arrange for and be responsible for preserving its books and records for the rest of the required period, generally at least five years, and notify the SEC in writing of the exact address where they will be kept. Migration plans should record where each archive lands.

Regulation S-P does not set a frequency. It requires written policies and procedures that protect against unauthorized access to customer information, so the firm sets the review cycle in those policies and has to follow it. Many firms use quarterly reviews, matching CIS Safeguard 5.1, which calls for validating active accounts at least quarterly.

No. The Division of Examinations states that its priorities are not an exhaustive list of the areas it will examine. Examiners scope each exam based on the firm's own risk profile, prior findings and current events, and priorities can shift during the year. The published list is a strong signal of emphasis, and a firm should expect questions outside it.

They are an annual document from the SEC's Division of Examinations listing the risks and practices examiners plan to emphasize for advisers, broker-dealers, funds and other registrants in the coming fiscal year. It is a staff statement, not a rule. The fiscal 2026 edition, released November 17, 2025, emphasized fiduciary duty, compliance programs, never-examined advisers, information security and Regulation S-P.

No. The SEC withdrew its 2023 predictive data analytics proposal effective June 17, 2025. Examiners apply existing rules instead: the compliance rule, Rule 206(4)-7, for policies and supervision; the Marketing Rule for claims about AI; Rule 204-2 for records; and Regulation S-P when client data reaches an AI vendor. The FY2026 exam priorities say staff will test AI representations and supervision.

The SEC's Fiscal Year 2027 Examination Priorities use "super intelligence (SI)" as the term for advanced AI. The Division says registrants are increasingly incorporating SI into their businesses and that threat actors use it to automate and accelerate cyberattacks, including SI-generated phishing and deepfake voice and video. Examiners will review how firms prepare for these threats and how they monitor SI use.

AI washing is the SEC's term for misleading claims that a firm uses artificial intelligence. In March 2024 the SEC settled charges against two investment advisers, Delphia (USA) Inc. and Global Predictions Inc., with civil penalties of $225,000 and $175,000, citing the Marketing Rule. Any AI claim in Form ADV, a website or marketing should be accurate and supported by records.

Under the FTC Safeguards Rule, the Qualified Individual approves MFA and encryption exceptions, and the MFA approval must be in writing (16 CFR 314.4(c)(3) and (c)(5)). Reg S-P names no approver for SEC-registered firms, so most advisers route exceptions through the CCO who administers the Rule 206(4)-7 program, often with the system owner co-signing.

The server will keep working, but it stops receiving security fixes unless the firm buys Extended Security Updates. Regulation S-P requires safeguards reasonably designed to protect against anticipated threats to customer information, so an examiner may ask how an unpatched server holding client data fits within the firm's written policies. Compliance counsel can advise on a specific firm's facts.

It can be. Regulation S-P defines a service provider as any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through services provided directly to the firm. A ZTNA broker sits in the path of traffic to systems holding customer information, so many firms include it in service provider oversight, including the 72-hour breach notice. Confirm the analysis with counsel.