RIA SEC Regulation S-P Checklist

Who this checklist is for

Registered investment advisers, wealth management firms, and their CCOs. Larger SEC-registered advisers had to comply with the amended Regulation S-P by December 3, 2025, and smaller entities by June 3, 2026.

What's inside

The checklist is a one-page PDF with ten controls. Each has a Pass / Gap box so you can mark it up in a team meeting:

1. Incident response program and 30-day customer notice. Maintain written procedures to detect, respond to, and recover from unauthorized access, and notify affected individuals as soon as practicable, no later than 30 days after becoming aware.
2. 72-hour service-provider notice. Make sure custodians, CRM, portfolio, and IT vendors are required to notify you within 72 hours of a breach affecting your customer information.
3. Phishing-resistant MFA on custodian and portfolio portals. Protect Schwab, Fidelity, Orion, Black Diamond, eMoney, Redtail, and Microsoft 365 logins against session-token theft.
4. Communications archiving. Capture and retain business communications across email, Teams, Slack, Zoom, and approved text channels.
5. 24/7 identity and endpoint monitoring. Watch for impossible-travel logins, inbox forwarding rules, and bulk client-list downloads.
6. Mobile device management. Enforce encryption, biometric lock, and selective wipe on advisor phones, tablets, and laptops.
7. Wire and disbursement fraud controls. Combine DMARC enforcement, email-security tooling, and out-of-band verification before acting on wire or ACAT instructions.
8. Disposal of customer information. Sanitize retired laptops, drives, and scanners (for example, to NIST SP 800-88) and keep the records.
9. Fast patching of remote access. Patch VPNs, gateways, and critical workstation flaws quickly, prioritizing CISA KEV entries.
10. Exam-ready documentation. Keep evidence of log retention, vendor due diligence, and tabletop exercises ready for an SEC examination.

How to read it

• SEC Rule 17a-4 (and its WORM option) applies to broker-dealers. Investment advisers keep books and records under Advisers Act Rule 204-2. Dual registrants and firms affiliated with a broker-dealer may need both.
• FINRA rules such as Rule 4370 (business continuity) apply to FINRA member firms, not to stand-alone RIAs.
• Patch timelines like "within 24 hours" and response times like "4 minutes" are Emry's service targets, not regulatory deadlines.

Download

Download the PDF checklist (1 page) →

Related resources

• IT security for wealth advisors and RIAs
• All resources