The vendor clock: amended Regulation S-P rests on a 72-hour promise someone else makes

The week

On May 16, 2024, the Securities and Exchange Commission adopted amendments to Regulation S-P, the rule on protecting customer information at broker-dealers (firms that buy and sell securities for customers), funding portals (platforms that help small companies raise money online), investment companies such as mutual funds, registered investment advisers and transfer agents (firms that keep records of who owns a fund’s or company’s shares). Regulation S-P has long required these firms to protect customer records. The amendments added specific expectations for what happens when that protection fails.

They also wrote into the rules something most people who invest through a broker or adviser never think about: where their personal details actually live. Their name, address, Social Security number, account numbers and balances feel as though they sit safely “at the firm.” In practice, they are usually spread across a chain of outside companies that the firm hires to run its business.

There were three main pieces. First, covered institutions must keep an incident response program for unauthorized access to customer information, a written, practiced plan for what to do when something goes wrong. Second, they must generally notify affected individuals within 30 days of becoming aware that sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization. Third, they must oversee their service providers, the outside companies that handle customer data for them. Those providers’ procedures must provide for notice to the institution as soon as possible and no later than 72 hours after the provider becomes aware of a qualifying breach.

That last clause had been tightened and then relaxed during the rulemaking. The original proposal had said 48 hours. The final rule settled on 72.

The amendments were published in the Federal Register on June 3, 2024. Firms were given time to prepare: compliance was due December 3, 2025 for larger entities and June 3, 2026 for smaller ones.

On the surface, the headline was the 30-day promise to customers. Underneath, the clause that would test firms hardest was the 72-hour promise made by someone else: the vendors who actually hold the data.

The SEC proposed these amendments in March 2023 alongside two other cyber rules. Of the three, the customer rule was the one adopted, and its most demanding clause was the one aimed at someone else.

Consider where a typical wealth manager’s customer data is held. It is with a custodian or clearing firm, which holds the actual assets and processes trades. It is in a portfolio management system, a CRM (customer relationship management software, the digital address book and activity log for every client), document storage, e-signature tools, email, financial planning software and the systems of an outsourced IT provider. The firm’s own office may hold very little. Its ability to protect and notify customers is mostly borrowed.

The vendor clause is the SEC’s attempt to make that borrowing explicit. It raises three questions in order: which providers it reaches, what the 72-hour promise actually secures, and how the vendor’s clock connects to the customer’s.

A plan, a deadline and the outside firms

Regulation S-P is, at heart, a privacy and safeguarding rule. It has long required covered firms to have written policies to protect customer records. What the 2024 amendments added is a set of obligations for the bad day: a plan, a deadline for telling customers, and a requirement to manage the outside firms that hold the data.

Three ideas do most of the work.

An incident response program is the organization’s written plan for a data breach. It sets out how a suspected breach is detected, who is called, how the damage is contained, how the facts are gathered and who decides what to tell customers and regulators. A good one is written down, assigns names to roles and is rehearsed.

Sensitive customer information is the kind of data whose exposure could cause real harm, such as information that could be used to open accounts or take money in someone’s name. The 30-day clock is tied to this category, and it runs from when the firm becomes aware that such information was, or was reasonably likely to have been, accessed or used without authorization.

Service provider oversight is the part that reaches outside the firm’s walls. The firm must have policies reasonably designed to ensure its providers protect customer information and tell the firm promptly, within 72 hours, if a qualifying breach occurs.

The position resembles that of a homeowner who has handed spare keys to a cleaner, a dog walker, a contractor and a neighbor. The homeowner is still responsible for the house. The new rule effectively says: know who holds your keys, make sure each of them has promised to tell you quickly if a key is lost, and be ready to warn your family when it happens.

Which providers it reaches

The rule defines a service provider as any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through services provided directly to the covered institution. Three features of that definition shape the inventory a firm needs to build.

First, it is direct. A CRM vendor’s hosting provider, the company whose data centers the CRM runs in, is not the firm’s service provider under the rule, even though a breach there exposes the firm’s customers. The firm’s visibility into that deeper layer depends entirely on what its direct vendor is obliged to pass on. In the house analogy, the cleaner may have lent your key to a subcontractor you have never met.

Second, some counterparties are covered institutions in their own right. A clearing broker-dealer has its own Regulation S-P obligations, including its own customer notice duties for the accounts it carries. Introducing firms, the smaller brokers that bring in customers but rely on a clearing firm to hold accounts and settle trades, needed to work out with their clearing firms who notifies whom, and in what order, before an incident forced the question. Without that agreement, a customer could receive two confusing letters, or none.

Third, access counts as much as storage. An outsourced IT provider with administrative credentials to the firm’s email tenant may hold no customer data in its own systems. (An email tenant is the firm’s private section of a cloud email service, and administrative credentials are the master keys to it.) That provider is still a service provider, and arguably the most dangerous one, because its compromise opens everything else.

A usable inventory therefore records more than vendor names. It notes what customer information each provider holds or can reach, whether the provider is itself a covered institution, and which of its own suppliers sit underneath. Most firms found the third column the hardest to fill.

A dozen vendors, three columns

Take a registered investment adviser with a few thousand clients. Its first vendor list, pulled from accounts payable, had a dozen names. Working through the three columns changed the picture. The custodian turned out to be a covered institution with its own notice obligations, so the two firms needed a written agreement on who would tell clients what. The IT provider held no client files but had administrator access to email, where advisers routinely received account statements and tax documents, so it moved to the top of the risk list. And the planning software vendor ran on a large cloud platform the adviser had never contracted with, which meant the adviser’s only source of information about problems there would be the planning vendor itself. The exercise needed no new technology, only the right questions put to each name on the list.

What the 72-hour promise secures

The rule does not regulate vendors directly. The SEC oversees the covered firms, not every software company they buy from. Instead, the rule requires the firm’s oversight policies to be reasonably designed to ensure that providers protect customer information and give notice within 72 hours. In practice that means a contract term, plus due diligence before signing and monitoring afterward.

The clause has narrower edges than its headline. The trigger is the provider’s awareness of a breach resulting in unauthorized access to a customer information system the provider maintains. The clock starts when the vendor knows, not when the breach happens. A provider that detects intrusions slowly can meet a 72-hour promise while learning of a breach months late.

Due diligence therefore has to cover detection capability as well as notice terms. Useful questions include log retention (how long the vendor keeps the records of who accessed what, which investigators need), monitoring coverage (whether someone is actually watching those records, around the clock) and whether the provider has its own incident response retainer, a pre-arranged contract with a specialist firm that can be called in quickly.

The clause also says little about content. Notice that a breach occurred is not the same as a list of affected accounts and data elements. A firm cannot write to customers, or judge which of them have sensitive information at stake, from a one-line email saying “we are investigating an incident.” Firms negotiating amendments added terms requiring the provider to identify affected customers, preserve logs, support the firm’s investigation and provide updates on a set cadence.

Bargaining power varied. Large platforms generally offered standard security addenda and would not sign bespoke terms. For them, the work was reviewing the standard language against the rule and documenting the conclusion, including any gap and the compensating steps taken. Smaller specialist vendors were often willing to sign but had limited ability to detect anything quickly. That trade-off is worth recording too, because an examiner will ask how the firm judged it.

How the vendor clock connects to the customer’s

The 30-day customer notice runs from the covered institution’s own awareness of unauthorized access, not from the incident itself. A slow vendor therefore does not technically shorten the firm’s deadline. It does delay the moment the firm knows, and every day of that delay is a day customers are exposed without warning, unable to watch their accounts more closely or change passwords.

Awareness can also arrive from elsewhere, such as press coverage or a customer complaint. A firm that hears about a vendor breach from the news starts its own clock without the facts it needs. It knows something has happened, its deadline is running, and the vendor that holds the answers may be overwhelmed by hundreds of other clients asking the same questions.

Firms can agree in writing that a service provider will send customer notices on their behalf. That can make sense for a custodian with good address data and a practiced notice operation. The firm still needs to approve the content, confirm the population and keep the records. Delegating the mailing does not delegate the obligation.

The sequencing work is concrete. Map each critical provider’s notice commitment to a named contact at the firm, monitored outside business hours, because breaches are discovered at all hours. Pre-agree the data the provider will hand over for notice. Run at least one tabletop exercise per year, a structured rehearsal around a realistic scenario, with a major provider in the room.

State breach notification laws continue to apply alongside the rule, and how the two fit together for a particular firm is a question for its lawyers.

One vendor breach, step by step

The two clocks interact most clearly on a timeline. Suppose a broker-dealer uses a document storage vendor to hold scanned account opening forms, which include clients’ Social Security numbers and copies of identity documents.

The breach begins. An attacker gets into the vendor’s systems. Nobody notices. Under the rule, no clock has started yet, because the vendor is not aware of anything. This is the stretch where the vendor’s detection capability, not its notice promise, determines everything.

The vendor finds out. Weeks later, the vendor’s monitoring team spots unusual downloads. Now the vendor’s clock is running: its procedures must provide for notice to the broker-dealer as soon as possible and no later than 72 hours.

The firm is told. On the second day, an email arrives. If it goes to a named, monitored contact, the firm’s incident response program starts immediately: the right people are called, counsel is engaged and the firm begins to assess whether sensitive customer information was, or was reasonably likely to have been, accessed. If it lands in a general inbox on a Friday evening, days may pass.

The facts arrive, or do not. The firm needs to know which clients’ files were in the affected storage and which data elements they contained. If its contract requires the vendor to identify affected customers and preserve logs, that information has a path. If not, the firm may be negotiating for facts while its own 30-day clock runs.

Customers are told. The firm drafts and approves notices, confirms the list of recipients, decides whether the vendor or the firm will send them, and keeps records of what was sent and when. If the firm’s clearing firm also has obligations to some of the same customers, the pre-agreed sequencing determines who writes first.

Laid out like this, the weak points are easy to see. They are not in the 30-day deadline itself. They sit in the stretch before the vendor notices, the handoff into the firm and the flow of detailed facts afterward. Each one can be strengthened in advance, and almost none can be fixed in the middle of the event.

Trust, examiners, concentration and cost

A firm can notify its clients only as quickly as its vendors notify the firm.

Customers and trust. Financial advice is a trust business. A client who learns of a breach late, or from the newspaper rather than their adviser, may reasonably wonder what else the firm does not know. Prompt, accurate notice is part of the relationship as much as a legal duty.

Regulatory exposure. Examiners will look at whether the firm’s vendor oversight was reasonably designed. A file that shows the firm asked hard questions, recorded the answers and made documented judgments is far stronger than a stack of unsigned contracts.

Operational risk. A firm that relies on a handful of platforms is, in a real sense, only as secure as the weakest of them. Knowing which vendor holds the master keys, and planning for its compromise, is basic risk management.

Cost. Investigations, customer notices, credit monitoring offers and legal advice all cost money. They cost more, and take longer, when the facts arrive slowly and in fragments.

What a prepared firm can produce

A well-prepared firm can produce, quickly, a vendor inventory with the three extra columns; a written agreement with its clearing firm or custodian on who notifies whom; vendor contracts or reviewed standard terms with documented judgments on each gap; a named out-of-hours contact for vendor breach notices; and a record of at least one rehearsal with a major provider.

The usual failures:

• Listing vendors from the invoice file. Accounts payable shows who gets paid, not who can reach customer data.
• Stopping at the 72-hour clause. A notice deadline without detection capability or content terms secures very little.
• Forgetting access-only providers. IT providers with master credentials often hold no data but can open everything.
• Assuming the clearing firm will handle it. Without a written agreement on sequencing, customers may hear twice, or not at all.
• Routing notices to a shared inbox. A breach notice that sits unread over a weekend is a lost weekend of response.

Where the vendor clock can fail a firm

• Which outside companies hold or can reach our customers’ information, and does our list show what each one holds, whether it is a regulated firm itself and who its key subcontractors are?
• Have we agreed in writing with our custodian or clearing firm who notifies which customers, and in what order?
• For our most important vendors, how quickly can they actually detect a breach, and how long do they keep the records investigators need?
• Do our vendor contracts require them to tell us which customers and which data were affected, as well as that something happened?
• Who at our firm receives a vendor breach notice at 9 p.m. on a Saturday?

The 30-day customer promise is the part of the rule the public will see. The 72-hour vendor promise is the part that determines whether a firm can keep it.

With hindsight

Both compliance dates have now passed: December 3, 2025 for larger entities, including advisers with $1.5 billion or more in assets under management, and June 3, 2026 for smaller ones. The rule is no longer a project on a planning calendar. It is a standard firms are measured against.

Regulators signaled how they would approach it. The SEC’s Division of Examinations listed the amended rule in its fiscal 2026 examination priorities, saying it would first assess firms’ preparation and then examine compliance once the dates arrived. For firm leaders, that sequence is a useful guide: examiners look first at whether the program exists and is sensibly designed, and then at whether it works. A vendor inventory with thin columns, or a notice clause with no detection behind it, is the kind of gap that sequence is designed to find.

The year the rule was adopted also showed why the vendor layer mattered. The 2024 campaign against Snowflake customer accounts, and other platform incidents, showed how much sensitive financial data sits with third parties, and how much a firm’s response depends on what those platforms can tell it. When a widely used platform is involved, every one of its customers is asking for facts at the same moment. Firms that had already agreed what data they would receive, and who would receive it, were better placed than those starting from a bare promise of notice.

A firm’s promise to its customers can be no stronger than the promises it has secured from the companies that hold their data, and no faster than those companies can see trouble coming. Knowing who holds the keys, what they have committed to and how quickly the firm will hear from them is now part of the basic duty of care.