The Reg SP amendments compliance date for smaller entities is June 3, 2026, and firms need to be ready on day one. By the deadline, smaller RIAs and registered firms need more than updated policies or a revised Reg SP Privacy Notice. They need a program that is documented, assigned, tested, and operating in practice.
With the larger-entity deadline already passed, smaller entities now have a limited window to confirm requirements, identify gaps, assign owners, and collect the evidence examiners may expect.
This roadmap outlines a step-by-step path to full compliance.
Key Takeaways
- SEC examiners will look for proof that your program is operating. Proof includes reviews of your training logs, tabletop exercises, and documented decisions.
- The amendments require a written incident response program, customer notification within 30 days of a breach determination, and vendor contracts that include a 72-hour breach notification obligation.
- Smaller entities must be fully compliant by June 3, 2026, with no grace period.
- Firms that wait to start risk losing the window to identify and remediate gaps before examiners may arrive.
The Reg SP Amendments Compliance Roadmap
Use this roadmap to help prepare your firm for the upcoming compliance date for Reg SP amendments for smaller entities.
Step 1: Confirm Smaller Entity Status
Start by determining whether your firm qualifies as a smaller entity under the SEC’s definitions. Document that classification internally with leadership and your CCO so there is a clear record of why the June 3, 2026, compliance date applies.
Step 2: Inventory What You Already Have
Catalog:
- Current information security policies
- Incident response artifacts
- Regulatory compliance procedures
- Privacy policy and brach notification procedures
- Vendor oversight processes
Step 3: Update or Rebuild
Some firms can patch existing policies to align with the amendments. Others need a clean rebuild to avoid maintaining a “paper program” that won’t hold up under examination. Prioritize consistency and operational substance over length.
Step 4: Assign Owners and Set Dates
Assign responsibilities across:
- Compliance
- IT and security
- Operations
- Legal
- Vendor management
As Greg Miller, CPA, CISA, Vice President of Consulting Services at Assurance Dimensions, explains, “A roadmap turns compliance into a manageable project: inventory what you have, assign owners, close the gaps, and test before the deadline.”
Step 5: Build the Operational Foundation
By the compliance date, your firm must have:
- A written incident response program designed to detect, assess, contain, and recover from unauthorized access.
- A customer notification process that meets the 30-day notification requirement.
- Vendor and service provider oversight, including contract provisions requiring 72-hour breach notification to your firm.
- Updated policies with retention procedures for incidents, investigations, and notices.
- Complete systems and data inventories covering platforms, critical dependencies, and confidential client data locations.
Step 6: Engage Qualified Support Early
A readiness assessment partner can identify gaps across:
- Incident response
- Vendor oversight
- Customer notification
- Safeguards
- Recordkeeping
As Miller notes, “If you wait until the deadline is close, you lose the remediation window. The goal is to be fully compliant on day one, not scrambling for documentation.”
Step 7: Test, Train, and Prove It’s Operating
Before the deadline:
- Complete company-wide security awareness training
- Run tabletop exercises for incident response and breach notification
- Collect evidence, including training logs, testing outputs, and vendor contract updates.
As Miller puts it: “The firms that do well with Reg SP aren’t the ones with the longest policies. They’re the ones that can show the program is operating, testing, training, vendor oversight, and documented decisions.”
How Assurance Dimensions Can Help
Assurance Dimensions helps firms of all sizes prepare for their Reg SP amendments compliance date by translating these requirements into a dated project plan, all tailored to the operational realities of RIAs and registered firms.
For small entities preparing for the June 3, 2026, deadline, our IT Advisory and Consulting team can support readiness assessments, gap identification, implementation planning, testing, and evidence collection before the compliance date arrives.