Turn your Regulation S-P policies into operational readiness.
Written policies are only the starting point. We help your Chief Compliance Officer (CCO) and leadership team identify implementation gaps, clarify incident response responsibilities and document how selected controls operate, working alongside your legal counsel.
Focus on implementation and ongoing review
The 2024 Regulation S-P amendments apply to SEC-registered investment advisers and other covered institutions. They address incident response, customer notification, service-provider oversight and related records.
The compliance dates were December 3, 2025 for larger entities and June 3, 2026 for smaller entities. Both have passed. The work now is to understand your implementation, address gaps and maintain the evidence supporting your program.
Regulatory information reviewed September 29, 2026. See the SEC’s small entity compliance guide and final rule .
What a scoped review can cover
Information and responsibilities. Map the agreed systems and providers handling customer information and identify the people responsible for key decisions.
Incident procedures. Review escalation paths, required inputs and coordination between your firm, counsel and technology providers.
Provider oversight. Examine available provider documentation and the responsibilities and communication arrangements relevant to your program.
Controls and evidence. Test selected controls and identify where the evidence is incomplete or does not support the stated procedure.
Follow-up. Document findings, action owners and the information needed to assess progress.
Turn the review into an actionable record
The agreed output can include a program-to-evidence matrix, a responsibilities map, selected control-test results and a prioritized remediation plan. A tabletop exercise may be added to explore how participants would coordinate a realistic scenario.
We agree the review scope and the role of your CCO and counsel before work begins. Your firm retains responsibility for its program and legal decisions.
Frequently asked questions
Will EXTRIMPA certify compliance?
No. We provide operational review and advisory support. We do not issue SEC certification, regulatory approval or a legal compliance opinion.
Can you work with our compliance consultant?
Yes. We can define a technology and evidence workstream that fits alongside your existing compliance and legal support.
Will you handle a live incident?
This service is preparation and review. It is not an emergency response service. Your incident response arrangements should identify the providers responsible for containment, investigation and recovery.
Are the provider and customer notification timelines the same?
No. They concern different responsibilities and triggers. Our article explains the distinction and why your firm should involve counsel in applying the rule.
Define the part of your program you need to examine
Start with your current procedures, the people involved and the questions you need the review to answer.