SEC Regulation S-P — incident response and customer-notification amendments
Enacted in force
Fields requiring verification
- enforcement date: Unverified — No distinct enforcement-start date was established. Primary source
- penalty amount: Unverified — Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description. Primary source
In plain English
- Covered brokers and dealers, investment companies, SEC-registered investment advisers and transfer agents registered with the SEC or another appropriate regulatory agency. Primary source
- Funding portals follow the applicable requirements through Regulation Crowdfunding. Primary source
- Larger and smaller covered institutions have different compliance periods. Primary source
- Adopt and maintain written incident-response policies to detect, respond to and recover from unauthorized access to or use of customer information. Primary source
- Provide the required customer notices as soon as reasonably practicable and generally within 30 days, subject to the rule’s investigation exceptions and authorized delay provisions. Primary source
- Oversee service providers, safeguard and dispose of covered information, and maintain the required written records. Primary source
Dates and phased obligations
Legal effective date: 2024-08-02. Larger covered institutions: compliance 2025-12-03; smaller covered institutions: compliance 2026-06-03. Primary source
Legal effective date is August 2, 2024. Section II.F phases compliance 18 months after June 3, 2024 publication for larger covered institutions (December 3, 2025) and 24 months for smaller covered institutions (June 3, 2026). The operative-date field carries the first cohort; the later cohort is explicit here. This does not cover every financial business. Source and qualifications
Questions from this record
Who does 17 CFR 248.30; 89 FR 47688 cover?
Covered brokers and dealers, investment companies, SEC-registered investment advisers and transfer agents registered with the SEC or another appropriate regulatory agency. Funding portals follow the applicable requirements through Regulation Crowdfunding. Larger and smaller covered institutions have different compliance periods. Primary source
What is the law’s status?
Enacted / in force Primary source
What date does this record track?
Legal effective date: 2024-08-02. Larger covered institutions: compliance 2025-12-03; smaller covered institutions: compliance 2026-06-03. Primary source
Has this record been verified?
This record’s accepted facts were last reviewed on 2026-11-13; unsupported comparison fields remain Unverified. Primary source
- SEC final rule, 89 FR 47688DATES; section II.F; final 17 CFR 248.30; funding-portal discussion
Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.