ClareNow

Understanding Vendor Liability For Investment Advisors: What Regulation S-P Means For Third-Party Risk

If you can’t systematically track your own controls, tracking third-party data access is even less likely.

Ben Tercha, Forbes Councils Member Forbes 28 May 2026, 10:45 2 min read 7/10

Understanding Vendor Liability For Investment Advisors: What Regulation S-P Means For Third-Party Risk

Key Takeaways

Regulation S-P, originally enacted in 2000 and amended in 2024, mandates that investment advisors have written policies for safeguarding customer records, including those held by third-party vendors.
The SEC brought at least three enforcement actions in 2025 against advisory firms for failing to oversee vendor data access, resulting in combined penalties exceeding $2.5 million.
A 2025 survey by the Investment Adviser Association found that 38% of advisors still rely on manual quarterly questionnaires to assess vendor security, versus automated continuous monitoring.
Third-party data breaches cost U.S. financial services firms an average of $5.9 million per incident in 2025, according to IBM's Cost of a Data Breach Report.
The SEC's 2026 examination priorities explicitly list vendor due diligence and ongoing monitoring as key areas of review for investment advisors.

Investment advisors face growing legal and financial exposure from third-party data breaches—yet many still lack systematic oversight of vendor controls. A single vendor misstep can trigger SEC enforcement under Regulation S-P, which now explicitly holds advisors accountable for their vendors' compliance. The rule, originally enacted in 2000 and strengthened through amendments in 2024, requires registered investment advisors to adopt written policies for safeguarding customer records and information, including those held by third-party service providers. Recent SEC actions against advisory firms for vendor-related lapses underscore the heightened enforcement posture. According to the SEC's 2024 examination priorities, cybersecurity and third-party risk management remain top areas of focus. For advisors, the challenge is twofold: first, conducting thorough initial due diligence on vendors that handle sensitive customer data; second, establishing ongoing monitoring mechanisms to ensure continued compliance. Many smaller advisors rely on periodic questionnaires rather than automated control tracking, a gap that regulators are increasingly targeting. Industry observers note that the cost of non-compliance—ranging from fines to reputational damage—far outweighs the investment in robust vendor management systems. Looking ahead, the SEC is expected to propose further rule changes that codify specific vendor oversight requirements, potentially including mandatory incident reporting timelines. Advisors that proactively integrate vendor risk into their compliance programs will be better positioned to avoid enforcement actions and maintain client trust.

Frequently Asked Questions

Regulation S-P is a U.S. Securities and Exchange Commission rule that requires investment advisors, broker-dealers, and other financial institutions to adopt written policies for protecting the privacy of customer financial information and safeguarding those records. The rule was amended in 2024 to strengthen requirements for third-party vendor oversight.

Under Regulation S-P, investment advisors are responsible for ensuring that their third-party vendors—such as custodians, technology providers, and data processors—also comply with the rule's safeguard requirements. If a vendor suffers a data breach or fails to protect customer information, the advisor can be held liable by the SEC for inadequate oversight.

Common mistakes include relying solely on initial due diligence without ongoing monitoring, using manual questionnaires instead of automated control tracking, failing to contractually require vendors to meet specific security standards, and not having a clear incident response plan that includes vendor-related breaches.

In 2025, the SEC settled at least three cases against advisory firms for failures in third-party vendor oversight. Penalties ranged from $300,000 to over $1 million and highlighted deficiencies in ongoing monitoring and failure to enforce contractual data protection obligations.

Advisors should conduct comprehensive vendor due diligence before engagement, include data protection clauses in contracts, implement continuous monitoring through automated tools, regularly review vendor security certifications, and ensure vendors report breaches promptly. The SEC expects a written vendor risk management program.

The SEC has made third-party risk a top examination priority as financial services increasingly rely on cloud platforms, AI tools, and outsourcing. High-profile vendor breaches and the growing value of customer data have made regulators more aggressive in holding advisors accountable for their vendors' security practices.

Original source

www.forbes.com

Read original

Discussion

Join the discussion

No comments yet. Be the first to share your thoughts!