Products

Resources

Compare

Careers

News

Book a Demo

Products

Resources

Compare

Careers

News

Book a Demo

Return

Regulation S-P: What advisors need to know

A conversation with Kamal Jafarnia, Chief Legal Officer at Vise

DEC 15, 2025 | 4MIN

Data protection is now a core regulatory priority. The SEC’s recent updates to Regulation S-P represent one of the most consequential developments to advisor privacy and cybersecurity rules in more than 20 years.

We spoke with Kamal Jafarnia, Vise’s Chief Legal Officer, to explain what changed, what advisors are responsible for, and how Vise supports compliance.

First things first:
What is Regulation S-P?

Regulation S-P is the SEC’s main rule governing privacy and protection of client data. It sets expectations for how investment advisors handle, safeguard, and properly dispose of non-public personal information, such as client financial and identifying data.

Because Vise acts as a subadvisor to SEC-registered investment advisors, we have a dual role under the rule:

We are a covered institution, with our own direct obligations.
We are also a service provider, meaning advisors must be able to rely on us to meet certain requirements on their behalf.

Because Vise acts as a subadvisor to SEC-registered investment advisors, we have a dual role under the rule:

We are a covered institution, with our own direct obligations.
We are also a service provider, meaning advisors must be able to rely on us to meet certain requirements on their behalf.

The rule isn’t new—so what actually changed?

Regulation S-P has existed since 2000, but the SEC’s amendments add three major, practical requirements:

Mandatory breach notifications: If sensitive client data is accessed—or likely accessed—affected individuals must be notified within 30 days.
Formal incident-response programs: Firms must maintain written plans explaining how they identify, contain, and fix cybersecurity incidents.
Clear service-provider oversight: Advisors must ensure vendors (including subadvisors like Vise) notify them of security incidents—typically within 72 hours of discovery.

In short: advisors are now explicitly responsible for overseeing their vendors’ data-security practices.

Regulation S-P has existed since 2000, but the SEC’s amendments add three major, practical requirements:

Mandatory breach notifications: If sensitive client data is accessed—or likely accessed—affected individuals must be notified within 30 days.
Formal incident-response programs: Firms must maintain written plans explaining how they identify, contain, and fix cybersecurity incidents.
Clear service-provider oversight: Advisors must ensure vendors (including subadvisors like Vise) notify them of security incidents—typically within 72 hours of discovery.

In short: advisors are now explicitly responsible for overseeing their vendors’ data-security practices.

When do advisors need to comply?

The SEC set different deadlines based on firm size:

Large firms (generally $1.5B+ AUM): compliance required by December 3, 2025
Smaller firms: compliance required by June 3, 2026

The SEC set different deadlines based on firm size:

Large firms (generally $1.5B+ AUM): compliance required by December 3, 2025
Smaller firms: compliance required by June 3, 2026

What does this mean if I use Vise?

There are two layers to this.

Vise’s own obligations: Vise complies directly with Regulation S-P. We maintain a formal incident-response plan, and if an incident affected end clients, Vise would handle the required client notifications. Advisors would not need to send duplicate notices, though we would coordinate closely.
Supporting advisors’ obligations: Advisors must now maintain policies that:
- Monitor and oversee service providers
- Require prompt notice of incidents (within 72 hours)
- Ensure affected individuals are notified if sensitive data is involved

Our policies and agreements are designed to support those requirements.

There are two layers to this.

Vise’s own obligations: Vise complies directly with Regulation S-P. We maintain a formal incident-response plan, and if an incident affected end clients, Vise would handle the required client notifications. Advisors would not need to send duplicate notices, though we would coordinate closely.
Supporting advisors’ obligations: Advisors must now maintain policies that:
- Monitor and oversee service providers
- Require prompt notice of incidents (within 72 hours)
- Ensure affected individuals are notified if sensitive data is involved

Our policies and agreements are designed to support those requirements.

How did Vise prepare for the amended rule?

We took a proactive approach, including:

Detailed regulatory analysis: We reviewed the amended rule, the SEC’s adopting release, industry commentary, and legal guidance.
Updates to our compliance framework: We formally incorporated the new privacy, security, and incident-response requirements.
A dedicated Incident Response Plan: While not every firm has one, we believe a standalone plan improves clarity, speed, and accountability during an incident.

The goal was simple: meet our obligations and make compliance easier for advisors who work with us.

We took a proactive approach, including:

Detailed regulatory analysis: We reviewed the amended rule, the SEC’s adopting release, industry commentary, and legal guidance.
Updates to our compliance framework: We formally incorporated the new privacy, security, and incident-response requirements.
A dedicated Incident Response Plan: While not every firm has one, we believe a standalone plan improves clarity, speed, and accountability during an incident.

The goal was simple: meet our obligations and make compliance easier for advisors who work with us.

What should advisors do now?

Two practical steps matter most:

Update your compliance policies: Your written policies should reflect the amended rule, including how you rely on service providers and expect timely breach notifications.
Strengthen vendor oversight: Regulators now expect advisors to verify—not assume—that vendors have appropriate safeguards and notification procedures in place.

Two practical steps matter most:

Update your compliance policies: Your written policies should reflect the amended rule, including how you rely on service providers and expect timely breach notifications.
Strengthen vendor oversight: Regulators now expect advisors to verify—not assume—that vendors have appropriate safeguards and notification procedures in place.

The bigger picture

Cybersecurity is no longer just a technical issue or a compliance checkbox. It’s fundamental to client trust.

Advisors hold deeply sensitive information about their clients’ financial lives. Regulators are raising expectations accordingly—and firms across the ecosystem need to meet them.

At Vise, we view Regulation S-P not just as a rule, but as part of our broader commitment to protecting client data and operating a secure, trustworthy platform.

Cybersecurity is no longer just a technical issue or a compliance checkbox. It’s fundamental to client trust.

Advisors hold deeply sensitive information about their clients’ financial lives. Regulators are raising expectations accordingly—and firms across the ecosystem need to meet them.

At Vise, we view Regulation S-P not just as a rule, but as part of our broader commitment to protecting client data and operating a secure, trustworthy platform.

The portfolio you'd build for your biggest client.
For every client.

Book a Demo

Product

Resources

Clients

521 Broadway

New York, NY 10012

+1 929 849 4840

Form ADV

Form CRS

1 Vise "Platform Assets" encompasses assets actively managed by Vise as well as assets that Vise aggregates, monitors, and uses to generate customized proposals. As of 6/1/2026.

2 This calculation is based on total realized losses as of 12/15/25 and assumes a long-term capital gains tax rate of 20% and a short-term capital gains tax rate of 41%.

3 Source: Cerulli Associates, U.S. Asset and Wealth Management Edition, 2021.

Tax-Loss Harvesting Disclosures

Vise AI Advisors, LLC (“Vise”) is an SEC-registered investment adviser. The material presented is for informational purposes only and should not be construed as investment advice. It is not a recommendation of, or an offer to sell or solicitation of an offer to buy, any particular security, strategy, or investment product. Nothing on this website should be construed as personalized investment advice, which can only be provided in one-on-one communications.

Investing in securities involves risks, including the potential loss of money, and past performance does not guarantee future results. Historical returns, expected returns, and probability projections are provided for informational and illustrative purposes and may not reflect actual future performance.

Product images shown are for informational and illustrative purposes only and may not reflect how they will appear within the product. Third-party trademarks and service marks referenced are the property of their respective owners.

The portfolio you'd build for your biggest client.
For every client.

Book a Demo

Product

Resources

Clients

521 Broadway

New York, NY 10012

+1 929 849 4840

Form ADV

Form CRS

1 Vise "Platform Assets" encompasses assets actively managed by Vise as well as assets that Vise aggregates, monitors, and uses to generate customized proposals. As of 6/1/2026.

2 This calculation is based on total realized losses as of 12/15/25 and assumes a long-term capital gains tax rate of 20% and a short-term capital gains tax rate of 41%.

3 Source: Cerulli Associates, U.S. Asset and Wealth Management Edition, 2021.

Tax-Loss Harvesting Disclosures

The portfolio you'd build for your biggest client.
For every client.

Book a Demo

Product

Resources

Clients

521 Broadway

New York, NY 10012

+1 929 849 4840

Form ADV

Form CRS

1 Vise "Platform Assets" encompasses assets actively managed by Vise as well as assets that Vise aggregates, monitors, and uses to generate customized proposals. As of 6/1/2026.

2 This calculation is based on total realized losses as of 12/15/25 and assumes a long-term capital gains tax rate of 20% and a short-term capital gains tax rate of 41%.

3 Source: Cerulli Associates, U.S. Asset and Wealth Management Edition, 2021.

Tax-Loss Harvesting Disclosures

Regulation S-P: What advisors need to know

Regulation S-P: What advisors need to know

First things first:What is Regulation S-P?

First things first:What is Regulation S-P?

The rule isn’t new—so what actually changed?

The rule isn’t new—so what actually changed?

When do advisors need to comply?

When do advisors need to comply?

What does this mean if I use Vise?

What does this mean if I use Vise?

How did Vise prepare for the amended rule?

How did Vise prepare for the amended rule?

What should advisors do now?

What should advisors do now?

The bigger picture

The bigger picture

The portfolio you'd build for your biggest client. For every client.

The portfolio you'd build for your biggest client. For every client.

The portfolio you'd build for your biggest client. For every client.

First things first:
What is Regulation S-P?

First things first:
What is Regulation S-P?

The portfolio you'd build for your biggest client.
For every client.

The portfolio you'd build for your biggest client.
For every client.

The portfolio you'd build for your biggest client.
For every client.