Regulation S-P for small advisers: the vendor file an examiner can ask for

Regulation S-P changed in 2024. Registered advisers with $1.5 billion or more in assets had to comply by December 3, 2025. Everyone else, which is most small RIAs, had to comply by June 3, 2026. That date has passed.

I read the SEC's adopting release (Release 34-100155) and 17 CFR 248.30 to see what a small adviser has to be able to show. Four duties matter.

What the rule asks for

Duty	The rule's words	What you can show
Incident response program	Written policies "reasonably designed to detect, respond to, and recover from" unauthorized access to customer information	The written program, plus who does what
Service provider oversight	Oversight "including through due diligence and monitoring, of service providers"	One entry per vendor with the due diligence you did
Provider breach notice	Providers must notify you "no later than 72 hours after becoming aware" of a breach	The clause or written confirmation, per vendor
Customer notice	"As soon as practicable, but not later than 30 days" after you become aware	The decision record and the notice

Advisers keep these records for at least five years, the first two in an easily accessible place (Rule 204-2).

The part most small firms skip

Incident response gets the attention. Vendor oversight is where the paperwork is. A five-person firm might have a custodian, a CRM, email, e-signature, planning software, a data aggregator and now one or two AI tools. Each of them holds customer information. Each needs an entry.

A minimal entry has five fields:

1. Vendor and what customer data it holds
2. Date of the last due diligence and what you looked at (SOC 2 report, security questionnaire, contract clause)
3. Whether the 72-hour breach notice is in the contract, confirmed by email, or missing
4. Who at the firm owns the relationship
5. Date of the next review

Fields 3 and 5 are the ones that are usually empty.

A rule for where to start

If a vendor holds customer names plus account numbers, do it first. If the contract has no notice term, ask for the 72-hour confirmation in writing before anything else, because that one email is the evidence. If a vendor will not answer, write down that you asked and when. A log that shows you asked is better than a log with no entry.

What I could not confirm

One law-firm alert in August 2026 reports that the SEC has started sending document requests about Reg S-P to advisers. I could not find that in an SEC publication, so treat it as a report, not a fact. What the SEC did publish: its FY2026 examination priorities say exams of Regulations S-ID and S-P "will focus on firms' policies and procedures, internal controls, oversight of third-party vendors, and governance practices." Vendors are named in the priorities themselves.

Disclosure

I used an AI assistant to read the adopting release and draft this post. The rule quotes come from the SEC text and I checked them by hand.

If you run compliance for small advisers and would pay for a finished vendor-oversight file per client, say so in the comments and tell me what it would need to include.