Under Regulation S-P, the firm that knows least about a breach tells the most customers

The week

On December 3, 2025, the first question a brokerage chief executive asks after an intrusion, whose information did they see, acquired a direct legal consequence and a direct price tag. That day was the compliance date for larger entities under the SEC’s May 2024 amendments to Regulation S-P. Regulation S-P is the Securities and Exchange Commission’s privacy rule for broker-dealers, investment companies, registered investment advisers and transfer agents, the firms that, respectively, execute trades, run funds, manage money and keep the official records of who owns which shares. Smaller entities had until June 3, 2026.

The amendments require a written incident response program for unauthorized access to or use of customer information. An incident response program is the firm’s plan for what happens when something goes wrong: who investigates, who decides, who communicates, and how the firm recovers.

Covered institutions must notify individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. “Sensitive customer information” means the kind of data that could be used to harm someone or steal their identity, such as a Social Security number, or an account number together with the code needed to get into the account. Notice is due as soon as practicable and no later than 30 days after the firm becomes aware of the incident.

The exception is where a reasonable investigation shows the information has not been, and is not reasonably likely to be, used in a way that causes substantial harm or inconvenience. The firm may stay silent only if it can show, with evidence, that silence is justified.

The rule does not apply to banks or credit unions, which have their own regulators and rules. But for the large slice of the investment industry it does cover, the week marked a shift in the burden of proof. Before, a firm looked to state breach laws to decide whether to tell customers. Now a federal rule said: tell them, unless you can show you need not.

The most contested clause of the 2024 amendments was the requirement that service providers report breaches within 72 hours. With the first compliance date in force, the in-house mechanics mattered more.

Before the amendments, Regulation S-P had no federal notice requirement, and firms worked from state breach laws. After them, notice is the default and silence needs a documented basis. That produces a counterintuitive result. A firm that cannot reconstruct what an intruder touched will usually notify more people than one that can. Ignorance does not protect a firm; it expands its obligations.

Three things determine which kind of firm it is: the evidence it keeps before an incident, the determination it makes during one, and the population of records it counts as in scope.

Detective work that depends on old records

When a firm discovers unauthorized access, it usually knows very little at first. An alert has fired, or a customer has reported something odd, or a vendor has called. The investigation that follows is detective work, and like most detective work it depends on records made before anyone knew they would matter.

The central records are logs. A log is a diary that a computer system keeps of what happens inside it: who signed in, from where, what they did. Some logs record only sign-ins, like a building’s visitor book that notes who entered but not which rooms they visited. Better logs record each action, including reads, the moment someone looked at a record without changing it. For a privacy investigation, reads are what matter. An intruder who views ten thousand customer records may change nothing at all.

The second key record is a data map: a document that says which systems hold which kinds of information, down to the individual fields, such as “this database holds Social Security numbers in this column.” Without a data map, an investigator who learns that system X was accessed still has to work out what was in system X.

With good logs and a good map, the investigation can answer the chief executive’s question precisely: the intruder viewed these 1,200 accounts, which contain these kinds of data. Without them, the honest answer is: the intruder had access to a system containing records on everyone, and we cannot tell which ones they looked at. Under the amended rule, those two answers lead to very different notice letters.

The evidence kept before an incident

The rule asks for a program reasonably designed to detect, respond to and recover from unauthorized access. It also asks firms to assess the nature and scope of an incident and identify the customer information systems and types of information involved. Both depend on records that must exist before anything goes wrong.

Three kinds matter most. Access logs for systems holding sensitive customer information need to record who queried which records as well as who logged in. Retention has to outlast a realistic detection gap, because intrusions are often found weeks after they begin. And a data map has to say which systems hold Social Security numbers, account numbers with access codes and other sensitive elements, by system and by field.

Each tends to fail in a familiar way. Default log retention in some cloud and software-as-a-service tiers is short, and extended retention is a separate purchase that nobody owns. Software-as-a-service, often shortened to SaaS, means software a firm rents and uses over the internet rather than installing on its own computers; the provider decides much of what is logged and for how long unless the customer pays for more. Application logs often record transactions but not reads, so they show what changed, not what was viewed. Data maps are usually drawn for applications. They leave out the file shares, exports and analytics copies where sensitive fields accumulate: the spreadsheet someone downloaded for a quarterly report, the copy of a database made for testing.

The fixes are procurement and configuration decisions with clear owners. Security operations should set minimum retention for each system in scope. Application owners should confirm that read access is logged where it matters. The privacy or data governance function should maintain the field-level map. The cost is mostly storage and engineering time, set against a notification bill that grows with every record a firm cannot rule out.

The determination made during one

The core of the amendment is the notification standard. A firm must notify unless a reasonable investigation supports a finding of no likely harm. That means the sensitive customer information has not been, and is not reasonably likely to be, used in a way that would cause substantial harm or inconvenience. The burden sits with the firm. Deciding not to notify is the decision that needs support, and the rule requires records of it.

Where a firm cannot identify which individuals’ information was accessed, it must notify everyone whose sensitive customer information resided in the affected system, unless it can make the same no-harm determination. This is where evidence turns into cost. With record-level read logs, a firm can show that an intruder queried a defined set of accounts and notify those people. Without them, the population defaults to the whole system.

The investigation also has to fit inside 30 days. In practice the clock forces decisions on partial facts. A sensible program sets internal checkpoints: scope hypothesis by the end of the first week, evidence review by the third, a notice decision with legal sign-off before day 30. It also assigns one person to keep the decision record, so that the reasoning behind a narrow notice survives an examination months later. The only route to delay is a written determination by the U.S. Attorney General that notice poses a substantial risk to national security or public safety. Firms should not plan around it, and the facts of any incident should be worked through with counsel.

The records counted as in scope

The amendments widened “customer information” to include information about customers of other financial institutions that a firm has received. A broker-dealer processing account transfers, an adviser receiving data from a custodian or a transfer agent keeping records for issuers holds data about people who are not its own customers. Those records count for protection and for notice.

That changes how scope is measured. Data inventories built from the customer master file, the firm’s main list of its own clients, miss these populations, because the people never became customers. Their records sit in transfer queues, reconciliation files, custodial feeds and archived correspondence. During an incident, a firm that has not mapped them faces a choice between notifying blind and missing people it was obliged to tell.

The same widening affects notice mechanics. A firm may hold sensitive data for someone with no current address on file, or whose relationship runs through another institution. Firms should decide in advance how they will reach those people, and whether to coordinate with the other institution. State breach laws continue to apply alongside the federal rule, so notices often have to satisfy several sets of content requirements at once.

Taken together, the three parts turn a notification rule into a data visibility requirement. Firms that invest in evidence and scope before an incident make narrower, better-supported decisions during one. Firms that do not will find the rule’s default does the deciding for them.

Two advisers, one incident, 40,000 letters or 900

Take two investment advisers of similar size, each with about 40,000 client accounts. Say both suffer the same incident: an attacker steals an employee’s password and uses it to sign in to the client relationship system for several days before being spotted.

The first adviser’s system keeps only sign-in records, held for 14 days under the default plan. The intrusion started three weeks before it was found, so even the sign-ins from the first week are gone. The firm can see that the account was used, but not what was viewed. It cannot make a credible no-harm finding. It notifies all 40,000 clients, plus several thousand people whose records arrived through account transfers from other firms, some of whom it has no current address for. It pays for mailing, a call center and identity protection offers for all of them.

The second adviser had, a year earlier, paid for extended log retention and switched on read logging for the fields that hold Social Security and account numbers. Its logs show the attacker opened 900 client records, mostly searching by name. Its data map shows which of those records held sensitive fields. Its incident team, working to the internal checkpoints, has a scope finding in the first week, an evidence review in the third, and a documented decision signed off by counsel before day 30. It notifies those 900 people, with a clear explanation, and keeps the record of why it did not notify the rest.

The incident was the same. The cost, the customer disruption and the strength of each firm’s position at its next examination were not.

Who owns what inside the firm

One reason these programs fail is that the pieces belong to different people who rarely meet. Laid out by function, the ownership looks like this.

• Security operations, the team that watches for and responds to attacks, owns detection, log collection and retention settings. It needs a budget line for storage, because longer retention costs money every month.
• Application and business owners, the managers responsible for each system, decide what each application records. They are often the only people who know that a system logs changes but not views.
• Privacy or data governance owns the data map and keeps it current as systems, exports and vendors change.
• Legal and compliance own the notice decision, the decision record and the coordination with state breach laws.
• Vendor management owns the contracts with service providers, which since the amendments must provide for those providers to report breaches to the firm within 72 hours.
• Client service owns the human side: call scripts, contact details for affected people, and the capacity to handle a surge of worried calls.

A senior executive does not need to understand each of these in detail, but does need to make sure each has a named owner, that the owners have rehearsed together, and that someone reports on the whole at least once a year. When an incident arrives, the 30-day clock leaves no time to discover that two teams each thought the other was keeping the logs.

State law adds a layer. States have their own data breach notification statutes, often with differing definitions of personal information, different deadlines and different requirements for what a letter must say. Some require notice to the state attorney general as well as to individuals. The federal rule did not replace these; it sits on top of them. A firm with clients in many states therefore needs letter templates and a decision process that can satisfy the federal standard and several state ones in the same mailing. Preparing those templates in advance is dull work that saves days when it matters.

A security gap with a per-letter price

The rule turns several abstract security topics into concrete business ones.

Cost. Notification is priced per person. Letters, call center capacity, identity monitoring and outside counsel all scale with the size of the population. Every system whose logs cannot narrow that population is a standing liability on the balance sheet, even if no one has written it down.

Clients. Investment relationships rest on trust. A letter telling a client their data may have been exposed, when in fact it almost certainly was not, still damages confidence. Narrow, accurate notice protects the clients who were affected and spares the rest an unnecessary scare.

Examiners. The SEC examines firms against their own written programs. A firm that decided not to notify needs to show why. A clean decision record is the difference between a short conversation and a long one.

Operations. Thirty days is not long. A firm that has to invent its process during an incident will spend those days arguing about roles rather than investigating.

The firm that can narrow its notice

A well-prepared firm can say, for each system that holds sensitive customer information, what it logs, how long it keeps logs, and who owns those settings. It has a field-level data map that includes exports, shared drives and analytics copies, and records about other institutions’ customers. It has rehearsed its 30-day timeline in a tabletop exercise, a structured walk-through of a pretend incident. It knows who keeps the decision record.

The firms that end up notifying everyone tend to share a few habits:

• Assuming the default logging in a rented software service is adequate without checking what it records and for how long.
• Logging changes but not reads, so the firm can prove nothing was altered but not that nothing was viewed.
• Building the data map from the application list and forgetting the spreadsheets, test copies and archives.
• Counting only the firm’s own customers, and missing people whose data arrived from custodians, transfers or issuers.
• Treating the no-harm exception as the starting point rather than as a conclusion that must be earned with evidence.
• Leaving the 30-day clock to run without internal checkpoints, so that decisions are made in a rush at the end.

How many letters the next breach would cost

1. For each system holding Social Security numbers or account access information, do we log who viewed which records, or only who signed in?
2. How long do we keep those logs, and is that longer than the time it typically takes to discover an intrusion?
3. Whose data do we hold that belongs to other institutions’ customers, and how would we contact those people?
4. If our largest client system were breached tomorrow, how many people would we have to notify with our current logs, and how many with better ones?
5. What are our internal checkpoints inside the 30-day window, and who keeps the record of the notice decision?

The question about our largest client system is often the most revealing. A firm that can put a number on the difference has a budget case for better logging that needs no further argument.

Listen, too, for how the answers are given. A team that answers with documents, owners and dates is in a different place from one that answers with reassurance. Under this rule, evidence rather than reassurance decides how many letters go out.

With hindsight

Both compliance dates held. Larger firms have been subject to the amendments since December 3, 2025, and smaller firms since June 3, 2026. The SEC withdrew many pending proposals from the previous administration in 2025, but these amendments were already final and were not part of that retreat. The agency named Regulation S-P compliance among its examination priorities for fiscal 2026, so the first exam cycles are now testing the programs firms built.

What we would emphasize in hindsight is the economics. The presumption of notice turned logging, retention and field-level data mapping into measures that reduce the size of a notice population, and therefore its cost. That is a stronger budget case than abstract risk reduction. The rule’s reach into other institutions’ customers also pushed firms to look at transfer and custodial data they had rarely inventoried. Firms that did that work before an incident have choices during one. Those that did not are left with the default.

In practice, security spending can now be tied to a number the finance team understands. Ask how many people a breach of each major system would force the firm to notify, and how much that would cost, with today’s logs and with better ones. The gap between those two figures is the value of the investment. Few security proposals come with such a clear return.

There is also a cultural point. A rule that makes notice the default rewards firms that know their own data well. That knowledge is useful far beyond breach response: it helps with client requests, with audits, with decommissioning old systems and with deciding what data the firm should stop collecting. The firms that treated the December 2025 date as a reason to understand their data, rather than as a paperwork exercise, are better run for it, whether or not they ever face an incident.