As a reminder, “Larger Entities,” including registered investment advisers with $1.5 billion or more in assets under management and any broker-dealer that is not a small entity under the Exchange Act (generally, any broker-dealer with more than $500,000 in total capital), must comply with revised Regulation S-P beginning on Dec. 3, 2025.

Smaller registered investment advisers and broker-dealers will need to start complying with revised Regulation S-P beginning on June 3, 2026.

Key Changes

The amendments to Regulation S-P (the “Amendments”) require that covered firms take a number of steps, including:

• Developing and implementing written policies and procedures for an incident response plan;
• Developing and implementing written policies and procedures providing for service provider oversight, including procedures reasonably designed to ensure service providers notify covered firms within 72 hours of security breaches involving “customer information systems”; and
• Notifying customers (including customers of certain other financial institutions) within 30 days in the event their “sensitive customer information” has been compromised.

The Amendments also broaden the scope of information covered by Regulation S-P, implement additional recordkeeping obligations for covered institutions, and provide an exception to the annual privacy notice delivery requirement.

MWS has already begun working to help firms meet these new requirements, including:

• Updating Incident Response Plan documentation; and
• Developing procedures and documentation regarding service provider outreach.

Authored by William Barbera, Kelly Koscuiszka, Tarik Shah, Elliot Golding and Amy Pimentel.

If you would like to discuss the Amendments or have any questions, we encourage you to contact one of the authors of this Alert or your attorney at McDermott Will & Schulte. Additionally, please join us tomorrow, Thursday, October 2, 2025, for a webinar in which McDermott Will & Schulte attorneys will further discuss the Amendment.

This material is for general information purposes only and should not be construed as legal advice or any other advice on any specific facts or circumstances. No one should act or refrain from acting based upon any information herein without seeking professional legal advice. McDermott Will & Schulte LLP* (McDermott) makes no warranties, representations, or claims of any kind concerning the content herein. McDermott and the contributing presenters or authors expressly disclaim all liability to any person in respect of the consequences of anything done or not done in reliance upon the use of contents included herein.

*For a complete list of McDermott entities visit mwe.com/legalnotices.

©2025 McDermott Will & Schulte LLP. All rights reserved. Any use of these materials including reproduction, modification, distribution or republication, without the prior written consent of McDermott is strictly prohibited. This may be considered attorney advertising. Prior results do not guarantee a similar outcome.