U.S. SEC Regulation S-P and Checklist: Compliance Deadline, December 3, 2025, Approaching for Large Entities

On May 16, 2024, the U.S. Securities and Exchange Commission (SEC or Commission) issued amendments to Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, which became effective on August 2, 2024 (the Final Amendments). The deadline for larger entities to comply with the Final Amendments is December 3, 2025, and for smaller entities, June 3, 2026.

At a high level, Regulation S-P sets forth requirements around the treatment of nonpublic personal information about consumers. The Final Amendments amend Regulation S-P requirements, generally, as they relate to “customer information” of “covered institutions.” Pursuant to the Final Amendments, “covered institution” generally is defined to include any brokers, dealers, investment companies, registered investment advisers, funding portals, and registered transfer agents as further specified in the regulation. The Final Amendments also address, among other things, the scope of written policies and procedures reasonably designed to safeguard customer information, incident response, notice of incidents involving sensitive customer information, service providers, recordkeeping, information disposal with regard to both customer information and “consumer information” as defined in the regulation, and annual privacy notices. The Final Amendments are complex and mandate a careful review of, and potentially significant updates to, existing policies and procedures for organizations otherwise subject to Regulation S-P.

Below is a high-level outline and checklist to guide you as a “final check” before the compliance deadlines. This document serves merely as a guide and is not meant to be legal advice or a replacement for legal advice. Sidley’s Privacy and Cybersecurity and Securities Enforcement and Regulatory teams can assist you on an expedited basis with any questions you may have related to the Final Amendments, including assisting you with developing a compliance and risk management program or updating components of any existing program, to address the requirements of Regulation S-P and the Final Amendments.

For summary definitions of “covered institution,” “customer information,” “financial institution,” “sensitive customer information,” and “service provider,” please refer to Appendix A to this checklist. A version of the checklist in table format that may be useful to complete while addressing the requirements of Regulation S-P is attached at Appendix B.

Do the Final Amendments to Regulation S-P Apply to Your Organization?

Is your organization a “covered institution” under the Final Amendments to Regulation S-P? Are you a registered investment adviser, broker, dealer, investment company, funding portal, or registered transfer agent?

If you have answered “yes” to these questions, your organization is within scope for the Final Amendments. You should continue through the checklist below.

To view the full checklist click here.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.