Regulation S-P Compliance: 5 Questions to Ask After the June 2026 Deadline

The June 3, 2026 compliance deadline for the SEC’s amended Regulation S-P has arrived for smaller entities. By now, most financial institutions are familiar with the rule’s requirements around safeguarding customer information, incident response, vendor oversight, and customer notifications. 

But now that the deadline is here, the question has changed. 

It’s no longer: Do you understand Regulation S-P?
It’s: What would happen if an SEC examiner showed up tomorrow? 

For many organizations, demonstrating that those policies are operational, tested, and supported by evidence is key. Examiners will want to see how it works, who owns it, and how you prove ongoing compliance. 

Here are five questions every organization should be asking right now.

1. Can You Produce Your Written Safeguards Program Today?

The amended rule requires organizations to adopt written policies and procedures designed to protect customer records and information. 

An examiner may ask: 

• Who owns your Regulation S-P program? 
• When was it last reviewed? 
• How are responsibilities assigned? 
• How do you ensure safeguards remain effective? 

A documented policy is an important first step, but examiners will likely want evidence that the program is being maintained and followed.

2. Could Your Team Respond to a Security Incident Tomorrow?

The amendments require organizations to establish written incident response policies and procedures designed to detect, respond to, and recover from unauthorized access to customer information. 

If an examiner asks for your incident response program, can you provide: 

• A documented incident response plan 
• Defined roles and responsibilities 
• Escalation procedures 
• Testing or tabletop exercise results 
• Evidence of periodic reviews 

Organizations that have never tested their response process may discover gaps during an actual incident—when the stakes are highest.

3. Do You Know Which Vendors Could Create a Regulation S-P Exposure?

Customer information often resides outside of your organization—in cloud platforms, software providers, managed service providers, and other third parties. 

The amended rule requires organizations to take steps to ensure service providers protect customer information and provide notice of security incidents. 

Ask yourself: 

• Do you maintain a current inventory of service providers with access to customer information? 
• Have vendors been assessed for security and privacy risks? 
• Do contracts include notification obligations? 
• Can you demonstrate ongoing oversight? 

If a vendor experiences a breach tomorrow, would you know about it in time to fulfill your own obligations?

4. Could You Meet the Notification Requirement?

One of the most significant changes under the amended rule is the requirement to notify affected individuals when sensitive customer information has been, or is reasonably likely to have been, accessed or used without authorization. 

Organizations should already have processes in place to: 

• Evaluate incidents quickly 
• Determine whether notification requirements apply 
• Coordinate legal and compliance review 
• Prepare customer communications 
• Document decision-making activities 

Waiting until an incident occurs to build these processes can create unnecessary risk and delay.

5. Can You Show Your Work?

This may be the most important question of all. Examiners will assess whether organizations can demonstrate compliance through documentation and evidence. 

That evidence may include: 

• Policy reviews 
• Risk assessments 
• Vendor due diligence records 
• Incident response testing 
• Training records 
• Remediation activities 
• Governance reporting 

If compliance information is scattered across spreadsheets, email threads, and shared drives, proving compliance becomes significantly more difficult. 

From Compliance to Examination Readiness 

The Regulation S-P deadline may have arrived, but examination readiness is an ongoing process. 

The organizations best positioned for regulatory scrutiny won’t necessarily be the ones with the most policies. They’ll be the ones that can demonstrate a mature, documented, and repeatable compliance program when regulators ask for proof.