The SEC's 2024 amendments to Regulation S-P (Adopting Release No. IA-6604, May 16, 2024) phased in by entity size: larger entities by December 3, 2025 and smaller entities by June 3, 2026. As of June 3, 2026, both compliance dates have passed and all covered institutions are expected to be in compliance.
## Who Counts as a Smaller Entity
For investment advisers, "larger entities" are those with $1.5 billion or more in regulatory assets under management; advisers with less than $1.5 billion (and other covered institutions below the applicable thresholds) are "smaller entities" that were subject to the June 3, 2026 date.
## What Smaller Firms Must Now Have
Covered institutions must maintain a written incident-response program; notify affected individuals of certain data breaches generally within 30 days; oversee service providers, including written agreements addressing breach notification; and keep related compliance records.
## Examination Focus
FINRA issued a member reminder of the approaching compliance date in November 2025, and Regulation S-P is named among the SEC's fiscal year 2026 examination priorities — so firms should expect examiners to test these programs in upcoming exams.