🔑
KEY TAKEAWAYS
- Reg S-P does NOT require written contracts (contrary to what some say)
- But you DO need "reasonably designed" policies to ensure vendor compliance
- Written commitments (contract, email, or public docs) are your best proof
- Beware: Many vendors don't know what "industry compliance" language commits them to
- Large providers (AWS, Google, Microsoft) often already comply via GDPR/other regs
The Short Answer: No, But Yes
Here's the confusion: some compliance consultants and industry commentators are telling RIAs that Regulation S-P requires written contracts with service providers that include specific promises about data protection and breach notification.
That's not accurate.
The SEC explicitly considered requiring written contracts in their proposal—and then deliberately chose not to mandate them in the final rule.
But before you breathe a sigh of relief and skip updating your vendor agreements, there's more to the story. While contracts aren't technically required, most RIAs will need them (or something very close) to actually demonstrate compliance. Let's break down what the rule really says and what you should actually do.
What the SEC Actually Said About Contracts
In the final amendments to Regulation S-P, the SEC made a critical modification from their original proposal. Here's the key language from the rule:
"In a modification from the proposal, rather than requiring written policies and procedures requiring the covered institution to enter into a written contract with its service providers to take certain appropriate measures, the policies and procedures required by the final amendments must be reasonably designed to ensure service providers take appropriate measures to: (A) protect against unauthorized access to or use of customer information; and (B) provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware of a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider."
Notice what happened there? The SEC removed the explicit requirement for written contracts. Instead, they require that your policies and procedures be "reasonably designed to ensure" that service providers:
- Protect customer information from unauthorized access
- Notify you within 72 hours of becoming aware of a breach
The SEC went out of their way to explain this change. They considered the contractual approach and deliberately rejected it. The rule focuses on the outcome (ensuring appropriate vendor behavior) rather than the method (requiring specific contract language).
So Why Will Most RIAs Need Contracts Anyway?
Here's the practical reality: while the SEC doesn't mandate written contracts, they do require that your policies and procedures be "reasonably designed to ensure" proper vendor behavior.
For most RIAs, the easiest—and often only practical—way to demonstrate this is through written agreements.
Think about it from an SEC examiner's perspective. If they ask, "How do you ensure your service providers will notify you within 72 hours of a breach?" what's your answer going to be?
- "We have a written contract that requires it" ✓ Clear, documented, defensible
- "We trust them to do it" ✗ Not reasonably designed
- "They said they would in an email" ✓ Could work (more on this below)
- "It's in their terms of service" ✓ Could work if clearly stated
Written commitments—whether in contracts, emails, or other documented forms—provide the evidence you need to show your oversight is "reasonably designed."
The Vendor Language Problem You Need to Know About
Many service providers include language in their agreements that sounds great on paper but may not actually protect you. Here's the most common example:
"Provider agrees to comply with all applicable laws and regulations in Client's industry."
Why This Is a Mixed Bag
The Good: Technically, this language probably meets the rule's requirements. If your vendor agrees to comply with your industry's regulations, and Reg S-P applies to your industry, then they're agreeing to meet Reg S-P standards—including the 72-hour notification requirement.
The Bad: Many service providers don't actually know what they're committing to. The Regulation S-P amendments are relatively new, and the specific requirements (like 72-hour breach notification) aren't common knowledge outside the financial services compliance world.
What You Should Do
If your vendor agreements include this type of "industry compliance" language, don't just assume it's enough. Take these steps:
- Ask your vendors directly: "Are you aware of the SEC's Regulation S-P amendments that took effect in 2024?"
- Confirm the 72-hour notification requirement: Make sure they understand they need to notify you within 72 hours of becoming aware of any breach involving your customer information
- Document their response: Keep records of these conversations (emails work great for this)
- Include it in your vendor oversight files: Your SEC recordkeeping should show you verified vendor understanding
If a vendor has never heard of Reg S-P and doesn't know what that "industry compliance" language commits them to, you've identified a risk that needs to be addressed.
What About the Big Providers? (AWS, Google, Microsoft, etc.)
The largest cloud and technology providers—Amazon Web Services (AWS), Google Cloud Platform, Microsoft Azure, and similar enterprise providers—present a unique situation.
They're Often Already Compliant
These major providers typically already meet or exceed Reg S-P requirements, not because they're specifically targeting SEC-registered RIAs, but because they operate globally and must comply with various data protection regulations, including:
- GDPR (European Union's General Data Protection Regulation)
- CCPA (California Consumer Privacy Act)
- HIPAA (for healthcare customers)
- Various international data protection laws
Many of these regulations already require breach notification to customers, often with timelines similar to or stricter than Reg S-P's 72-hour requirement.
The Documentation Challenge
Here's where it gets tricky: these providers' agreements are complex, often with multiple layers:
- Master Service Agreement
- Data Processing Addendum (DPA)
- Service-Specific Terms
- Privacy and Security Addendums
- Compliance Certifications
The breach notification commitments you need might be buried in a Data Processing Addendum, referenced in a security whitepaper, or documented in their compliance certification materials.
What You Should Do
For large providers like AWS, Google, or Microsoft:
- Review their Data Processing Addendum (DPA) - This typically contains breach notification language
- Check their compliance documentation - Look for SOC 2 reports, security whitepapers, and compliance certifications
- Document what you found - Create a summary in your vendor oversight file showing where their commitments are documented
- Don't assume all their services are the same - A commitment in the AWS DPA might not automatically apply to every AWS service you use
The key is documenting that you've verified these commitments exist, even if they're spread across multiple documents.
The Standard RIAs Should Aim For
Based on the rule's "reasonably designed" standard, here's what we recommend:
Preferred: Written Vendor Commitments
The gold standard is having vendor commitments to Reg S-P standards in writing. This could be:
- In the contract itself (preferred for simplicity)
- In a separate addendum or Data Processing Agreement
- In email correspondence from an authorized vendor representative
- In public statements or documentation from the vendor (like security whitepapers or compliance certifications)
- In other written statements that a reasonable person could rely on
What Matters: Reasonable Reliance
The key question is: "Could a reasonable person rely on this documentation to demonstrate that the vendor has committed to appropriate data protection and timely breach notification?"
If the answer is yes, you're probably in good shape—even if it's not in a traditional contract.
Practical Steps for RIA Compliance
Here's your action plan for service provider agreements under Reg S-P:
1. Inventory Your Service Providers
List every vendor that handles, stores, processes, or has access to customer information:
- Custodians
- CRM providers
- Cloud storage (Dropbox, Google Drive, etc.)
- Email providers
- Portfolio management software
- Marketing platforms
- IT service providers
- Any other third party with access to client data
2. Review Existing Agreements
For each provider, identify where (if anywhere) they've committed to:
- Protecting customer information from unauthorized access
- Notifying you of breaches within 72 hours (or "promptly" or "without undue delay")
- Cooperating during incident investigations
3. Fill the Gaps
For providers where commitments are unclear or missing:
Option A: Request a contract addendum with specific language
Option B: Request written confirmation via email
Option C: Document their public commitments (for large providers)
Option D: Evaluate whether to switch to a different provider
4. Document Everything
Create a vendor oversight file that includes:
- Copies of relevant contract sections
- Emails confirming commitments
- Links to or copies of public documentation
- Notes from conversations with vendors
- Your assessment of each vendor's compliance
5. Monitor Ongoing
Reg S-P requires ongoing monitoring of service providers, so:
- Review vendor agreements annually
- Check for changes to vendor terms of service
- Reassess vendor security posture regularly
- Update your documentation when vendors are acquired or change their services
Common Questions
Q: Can I use the same contract language for all my vendors?
A: You can use similar language, but the specific commitments should be appropriate for what each vendor does. A custodian needs different security measures than a marketing email provider.
Q: What if a vendor refuses to agree to 72-hour notification?
A: This is a red flag. If a vendor won't commit to timely breach notification, you need to seriously evaluate whether you can use them while maintaining Reg S-P compliance. You might need to find an alternative provider.
Q: Do I need a lawyer to review all my vendor contracts?
A: For your most critical vendors (custodian, CRM, core IT infrastructure), legal review is wise. For lower-risk vendors, documented email confirmations might be sufficient.
Q: What about vendors that only handle public information?
A: If a vendor truly has no access to nonpublic personal information (NPI), Reg S-P's service provider oversight requirements don't apply. But be careful—many vendors you might think don't have access to NPI actually do (like website analytics that capture form submissions).
The Bottom Line
Regulation S-P doesn't require written contracts with service providers—but the "reasonably designed" standard means you'll need documented commitments from your vendors in some form.
For most RIAs, traditional contracts or addendums will be the clearest path to compliance. But emails, public documentation, and other written statements can also work, especially for large enterprise providers.
The key is being able to demonstrate to an SEC examiner that you've taken reasonable steps to ensure your service providers will:
- Protect customer information appropriately
- Notify you within 72 hours of a breach
- Cooperate during incident investigations
Don't let anyone tell you that Reg S-P "requires" written contracts—that's not what the rule says. But also don't assume you can skip vendor agreements entirely. The practical reality is that written commitments, in whatever form, are your best evidence of compliance.
Need help reviewing your vendor agreements for Reg S-P compliance? That's exactly what we do at CyberSecureRIA. We can help you assess your current vendor relationships, identify gaps, and create the documentation you need for your next SEC exam.
Related Resources:
