TheCorporateCounsel.net

Yesterday, the SEC announced that it had adopted amendments to Regulation S-P, which are the rules that that govern the treatment of consumers’ nonpublic personal information by certain SEC-regulated financial institutions, such as broker-dealers, funding portals, investment companies, registered investment advisers, and transfer agents. In a fairly rare move these days, the Commission unanimously supported the adoption of these amendments. Regulation S-P has been around since 2000 and was adopted pursuant to the Gramm-Leach-Bliley Act. These amendments were proposed back in March 2023.

As noted in the SEC fact sheet about the amendments, the SEC’s action modernizes and enhances the protection of consumer financial information by:

– Requiring covered institutions to develop, implement, and maintain written policies and procedures for an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information;

– Requiring that the response program include procedures for covered institutions to provide timely notification to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization; and

– Broadening the scope of information covered by Regulation S-P’s requirements.

These amendments will become effective 60 days after publication in the Federal Register. Larger entities will have 18 months after the date of publication in the Federal Register to comply with the amendments, and smaller entities will have 24 months after the date of publication in the Federal Register to comply.

– Dave Lynn