Cybersecurity has long been treated as an operational issue for RIAs: important, technical, and often delegated to IT vendors or compliance consultants. But with the U.S. Securities and Exchange Commission’s (SEC’s) amended Regulation S-P compliance deadline approaching for smaller firms (AUM < $1.5B), cybersecurity is becoming something more: a client-trust issue.

For smaller RIAs, the compliance date is June 3, 2026. Larger firms have already been subject to the amended requirements since December 2025. The distinction matters because smaller firms received more time, but not a fundamentally different set of obligations.

What Smaller Firms Are on the Hook For

The amended rule places new emphasis on having a written incident response program, notifying affected clients when sensitive information has been accessed or used without authorization, maintaining appropriate records, and overseeing service providers that handle client information. For RIAs that rely on outside technology platforms, custodians, CRMs, reporting tools, marketing systems, and outsourced operations support, vendor oversight is especially important.

This is not happening in a vacuum. RIAs are managing more client data across more systems than ever before, while cyber threats continue to evolve. A recent Kitces industry roundup noted that, according to data compiled by the Massachusetts Office of Consumer Affairs and Business Regulation, 108 financial services companies一including dozens of RIAs and broker-dealers一had experienced data breaches as of April 30, 2026.

Some incidents were directly tied to firms, while others involved third-party relationships. Phishing, business email compromise, credential theft, vendor breaches, and AI-enabled social engineering are no longer abstract risks. They’re real business risks that can damage client relationships as much as firm operations.

A Different Way to Frame Readiness

This is why Reg S-P readiness should not be treated as a check-the-box compliance project. It is an opportunity for firms to ask a more client-centered question: Could we clearly explain how we protect client information, how we would respond to an incident, and how we monitor the vendors we trust with sensitive data?

Where to Start

A practical readiness review should include five steps.

1. Confirm that the firm has a written incident response plan that reflects how the business actually operates.
2. Identify all vendors with access to client information and review contractual expectations regarding breach notification and data protection.
3. Clarify who is responsible for client communications in the event of an incident.
4. Train employees on current cyber risks, especially phishing and impersonation attempts.
5. Prepare plain-English messaging before a crisis, so clients hear from the firm quickly and confidently if something goes wrong.

Takeaway: For RIAs, cybersecurity is now part of the fiduciary conversation. Protecting client assets remains central to the advisory relationship, but protecting the personal information behind each financial plan is increasingly part of the same promise. The firms that approach Reg S-P this way may not only reduce compliance risk, they may also strengthen the trust clients already place in them.

“I still think we’re in a reflationary backdrop as long as growth holds—and a reflationary backdrop by definition is risk-on. If growth softens, you go back to a stagflationary environment, which is risk-off. The data is going to have to tell us where we’re headed.”
 一Timothy Reilly, President

Is the Recession Playbook Broken?

Apollo’s Torsten Slok has a sobering message for anyone counting on a Fed rescue: the old recession playbook may be broken. With a government running large, deficit‑financed short‑term issuance, inflation proving stickier than the Fed hoped, and a fiscal path that is structurally bearish for bonds, the next downturn may arrive without the rate‑cut lifeline markets have come to expect.