The SEC adopted amendments to Regulation S-P in May 2024, and both compliance dates have now passed. Larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026. For chief compliance officers and vendor management leads at broker-dealers and registered investment advisers, the question has shifted from planning to proof: can the firm show an examiner that its service provider contracts and oversight match what the rule now requires?
The amended rule reaches beyond the firm's own systems. Covered institutions, which include broker-dealers, funding portals, investment companies, registered investment advisers and transfer agents, must maintain an incident response program and written policies and procedures for overseeing service providers that handle customer information. Much of that oversight lives in contracts that were signed years before the amendments existed.
This guide covers Reg S-P service provider oversight from the contract side: what the rule expects, which clauses to check, how to run a repapering inventory, and what evidence to have ready for an exam.
What the amended rule expects from service provider oversight
The amendments tie service provider oversight directly to the firm's incident response program. Firms need policies and procedures reasonably designed to require oversight of service providers, including through due diligence and monitoring. The core expectations break down as follows.
- Protective measures, service providers must be required to take appropriate measures to protect against unauthorized access to or use of customer information.
- 72-hour provider notice, service providers must notify the covered institution as soon as possible, and no later than 72 hours after becoming aware of a breach resulting in unauthorized access to a customer information system the provider maintains.
- Customer notification, the covered institution must notify affected individuals as soon as practicable, and no later than 30 days after becoming aware that unauthorized access to or use of sensitive customer information has occurred or is reasonably likely to have occurred, with a limited delay available on national security or public safety grounds.
- Retained responsibility, a firm may contract with a service provider to send notices to individuals on its behalf, but the covered institution remains responsible for meeting the notification obligation.
- Documentation, the amendments added recordkeeping requirements, so firms need written records showing their policies, oversight activities and incident decisions.
The practical implication is that the 72-hour clock in your vendor contracts feeds the 30-day clock you owe customers. If a provider's contract allows a vague or slower notice period, the firm's own deadline gets harder to meet, and the gap becomes an exam finding.
Examiners will look for policies, but they will also ask how those policies reach vendors. A signed clause with a 72-hour notice duty, an owner who tracks it and a record of monitoring is what makes the policy real.
Contract clauses to check in every covered agreement
Not every vendor needs the same treatment. Focus first on providers that receive, maintain, process or have access to customer information, then check each agreement for the following.
- Breach notification timing. Confirm the provider must notify the firm as soon as possible and no later than 72 hours after becoming aware of a breach affecting a customer information system it maintains, with a named contact and a defined notice channel.
- Security measures. Look for an obligation to maintain appropriate safeguards, with enough specificity to monitor, such as encryption, access controls and incident handling standards.
- Cooperation and information rights. The provider should supply the facts the firm needs to assess whether sensitive customer information was accessed and whether notice is required.
- Notice delegation. If the provider will send customer notices, the contract should define content, timing, approval by the firm and evidence of delivery, since responsibility stays with the firm.
- Oversight and subcontractors. Check for audit or assessment rights, reporting duties, flow-down of obligations to subcontractors and return or destruction of customer information at termination.
A five step repapering roadmap
Step 1, Build the inventory of covered providers
Start with your vendor master and accounts payable data, then cross-reference system owners and data maps to identify every provider with access to customer information. Include custodians, technology platforms, cloud hosts, call centers, print and mail vendors and affiliates. Record the entity, service, data categories and the agreements in force, including master agreements, order forms and data protection addenda.
Step 2, Extract and compare clauses at scale
Use AI-assisted review to pull breach notification, security, cooperation, audit and termination language from each agreement into structured fields. Compare each against your standard: notice within 72 hours, a defined contact, cooperation duties and subcontractor flow-down. Flag agreements with silent, vague or longer notice periods. The third-party risk contract automation guide covers how teams run this comparison across large vendor populations.
Step 3, Prioritize and repaper
Rank gaps by the sensitivity of the data and the provider's role. Send a standard amendment or addendum to high-priority vendors first, with fallback positions approved in advance. Track each negotiation to closure and record why any exception was accepted, who approved it and what compensating controls apply. For vendors that will not sign, document the risk decision and escalation.
Step 4, Turn clauses into monitored obligations
A signed clause only helps if someone watches it. Convert notice duties, assessment rights and reporting obligations into tracked obligations with owners, due dates and evidence requirements. Schedule periodic due diligence reviews, security questionnaires and assessments. Connect the provider notice channel to your incident response program so that a 72-hour notice starts the firm's 30-day assessment immediately.
Step 5, Assemble the exam evidence file
Keep a current evidence pack: the inventory of covered providers, clause comparison results, executed amendments, exception approvals, monitoring records and any incident logs with notification decisions. Tie it to the controls you already test. The SOX and third-party risk exam checklist is a useful model for organizing that file.
See Reg S-P repapering in action
Aavenir finds covered vendor contracts, flags notice gaps and tracks amendments and monitoring evidence for exams.
Exam readiness now that compliance dates have passed
With both compliance dates behind us, examiners can reasonably expect firms to show a working program rather than a project plan. Be ready to explain how you identified covered providers, how contracts were brought into line, and how you monitor ongoing performance. Be prepared to walk through a tabletop or real incident and show when the provider notified you, how you assessed sensitive customer information and how you reached the customer notice decision. Examiners may also test whether the program reaches beyond the largest vendors, so show how smaller providers with customer data access were identified and reviewed. If a vendor still refuses the 72-hour clause, show the escalation, the compensating controls and the date the decision will be revisited. Gaps are easier to defend when they are documented, prioritized and moving toward closure than when they are discovered in the exam room.
Evidence map for Reg S-P service provider oversight
This table links each requirement to the contract term that supports it and the evidence an examiner is likely to request.
| Requirement | Contract term to check | Evidence to keep |
|---|---|---|
| Provider breach notice | Notice as soon as possible, no later than 72 hours, named contact | Clause extract per vendor and notice test records |
| Protective measures | Security safeguards, access controls, incident handling | Due diligence questionnaires and assessment results |
| Customer notification | Cooperation and information sharing duties | Incident log with assessment and notice decision |
| Delegated notices | Content, timing, firm approval, delivery proof | Approved notice templates and delivery records |
| Ongoing oversight | Audit rights, reporting, subcontractor flow-down | Monitoring calendar, reviews completed, exceptions log |
Reg S-P service provider oversight comes down to three things an examiner can verify: the right clauses in the right contracts, named owners who monitor them, and records that show the program works. Firms that treat repapering as a one-time project will drift. Firms that track notice duties and monitoring as live obligations will have their evidence ready whenever the exam letter arrives.
For related guidance, see OCC and FFIEC vendor oversight, the contract controls, Sub-custodian oversight: the agreement duties that matter and Vendor contract controls for OCC and FFIEC exam readiness.
