SEC Regulation S-P: Build the Evidence Behind Customer Incident Notices
Know who may be affected, decide what to send, and keep the response record
Published
A financial firm's provider reports unauthorised access to account-opening files. Your team needs to answer three questions: Who may be affected? Is notice required? What happened to each notice? One connected incident file should show the answers and the evidence behind them.
Three steps to a complete response record
- 1 · Identify
Connect files to people
Keep the evidence and the affected-person list.
- 2 · Decide
Record the notice decision
Keep the reasons and any approved notice.
- 3 · Follow through
Track every required notice
Keep delivery outcomes and unresolved actions.
Two clocks with different starting points
Record both awareness times and the facts that establish them. Provider alerts and customer notices have different triggers:
Provider → institution
72 hours
As soon as possible, no later than this limit.
Starts when the provider becomes aware of a security breach resulting in unauthorised access to a customer information system it maintains.
The institution's oversight procedures must be reasonably designed to ensure this provider notification. SEC guidance
Institution → affected individuals
30 days
As soon as practicable, no later than this limit.
Starts when the institution becomes aware that unauthorised access to or use of customer information occurred or is reasonably likely to have occurred.
The notice obligation concerns affected individuals' sensitive customer information, subject to the rule's exceptions. SEC overview
These limits do not add up to “72 hours plus 30 days”. The institution's clock may already be running. Waiting for a final report or an approval meeting does not reset it.
Who is covered, and when did the requirements start?
The SEC compliance guide covers broker-dealers, including funding portals, investment companies, SEC-registered investment advisers, and transfer agents registered with the SEC or another appropriate regulatory agency. Compliance dates were December 3, 2025 for larger entities and June 3, 2026 for smaller entities. Both have passed. Confirm your firm's coverage and any additional state or sector obligations.
Follow the account-opening incident through the case file
1. Who may be affected?
The workConnect the affected files and versions to people. Check shared accounts, provider copies, and information held for other financial institutions. Separate confirmed facts from unresolved scope.
Keep in the fileOriginal evidence, collection details, customer mappings, the matching method, and reasons for including or excluding each person.
Missing logs do not establish that someone was unaffected. If specific affected individuals cannot be identified, the rule generally requires notice to everyone whose sensitive information resides in the affected system, with exclusions where the institution reasonably determines their information was not accessed or used without authorisation.
2. Is notice required, and what should it say?
The workCompliance records the decision. Where notice is required, reviewers approve the incident-specific wording and recipient list. Use a prepared template checked against the notice requirements.
Keep in the fileThe decision and its basis, deadline, approver, exact notice version, and recipient list used for each batch.
The decision concerns sensitive customer information: information whose compromise could reasonably risk substantial harm or inconvenience. Record the reasoning behind any exception or authorised delay.
3. What happened to each required notice?
The workMatch delivery results to the approved recipient list. Assign failed messages, returned mail, and missing results for follow-up or an approved alternative channel.
Keep in the fileEach notice, sending reference, channel, time, provider result, retry, and unresolved action.
“Accepted by the email provider” does not mean “received or read”. Keep those outcomes separate. The institution remains responsible for required notices even when a provider sends them on its behalf.
Keep the detailed checks close to the workflow
Notification decisions, exceptions, and notice contents
Under the final rule, an institution may decide against notice after a reasonable investigation if it determines that sensitive information has not been, and is not reasonably likely to be, used in a way that would cause substantial harm or inconvenience. National-security or public-safety delays require the rule's Attorney General process.
Notice requirements include clear written notice through a means reasonably expected to reach the individual. Cover the incident, information involved, dates where reasonably determinable, contact channels, and required account-monitoring, fraud-alert, credit-report, and identity-theft guidance. Retain a written agreement if a provider notifies on the institution's behalf.
Technical check: can you establish which files were accessed?
Verify logging across application, storage, export, and provider routes before an incident. For S3, CloudTrail object data events need configuration; they are not logged by default or included in ordinary Event history. A generated download link alone does not prove retrieval. Restrict raw customer data and privileged advice to the appropriate reviewers.
Retention check: what must remain after the incident closes?
Keep policy versions, provider oversight records, findings, decisions, notices, and delivery evidence. Retention requirements vary by institution and record type. Define the schedule, starting event, access needs, and holds. Coordinate disposal of working copies and unnecessary customer data, and test that a reviewer can retrieve the response file.
Can your team produce these four records?
Use the provider incident in a tabletop exercise. Ask the team to show:
- The timeline: awareness times, deadline basis, and responsible owner.
- The affected-person list: evidence, matching method, and unresolved questions.
- The decision: reasons, approval, and any notice prepared for dispatch.
- The outcomes: delivery evidence, follow-up actions, and retained records.
Keep the notice decision and its outcomes explainable
Connect the awareness timeline, affected-person analysis, notification decision, and exact approved notices in one incident record. Reconcile required notices with delivery results and unresolved actions, then retain the evidence needed to explain the response.