RIAs Face This Week’s Reg S-P Compliance Deadline
As smaller firms comply with the Securities and Exchange Commission’s changes to Regulation S-P, experts are warning reps to ensure their incident response plans for cybersecurity events are up to date and workable. The Reg S-P changes were passed in late 2024, which updated (and expanded) firms’ responsibilities for safeguarding consumer data.
Firms with over $1.5 billion in managed assets had a Dec. 3, 2025, compliance date, while firms below the threshold face a deadline this week, on June 3. Among the changes are requirements to update incident response programs, a 30-day requirement for consumer notification, and a 72-hour deadline for vendors to inform RIAs of cyber incidents.
In a discussion with Wealth Management, Michael Cocanower, the founder and CEO of RIA IT consulting firm itSynergy, said responses from clients about the Reg S-P ran the gamut from complete preparedness to total surprise. According to Cocanower, RIAs’ backup and disaster recovery/business continuity plans did not serve as replacements for an incident response plan, which details how a firm will respond to a cybersecurity attack, and he said RIAs had complained that there was little guidance available on how to craft such a plan.
Read more on what STP’s subject matter expert, Lori Weston had to say here.
