The U.S. Securities and Exchange Commission (SEC) has announced amendments to Regulation S-P, aimed at modernizing and enhancing rules regarding the handling of non-public personal information by certain financial institutions.

These amendments update the requirements for broker-dealers (including funding portals), investment companies, registered investment advisers, and transfer agents to address the risks associated with the expanded use of technology since the Commission initially adopted Regulation S-P in 2000.

The amendments require:

• Covered institutions to develop, implement, and maintain written policies and procedures to establish a reasonably designed incident response program for detecting, responding to, and recovering from unauthorized access to or use of customer information.
• The response program includes, with certain limited exceptions, a requirement for covered institutions to notify individuals whose sensitive customer information has been or is reasonably likely to have been accessed or used without authorization.
• Covered institutions must provide notification as soon as possible but no later than 30 days after becoming aware of an incident involving unauthorized access to or use of customer information. The notification must include detailed information about the incident, the compromised data, and measures affected individuals can take to protect themselves from the breach.

These amendments will become effective 60 days after publication in the Federal Register. Larger entities must comply with the amendments within 18 months of the Federal Register publication date, while smaller entities must comply within 24 months of the Federal Register publication date.