SEC Urged to Revise Data Breach Standards for Investment Companies and Advisers

The American Bankers Association, along with seven other associations, has written a joint letter to the Securities and Exchange Commission (SEC) advocating for revisions to its data breach standards for investment companies and advisers. Specifically, they are calling for increased clarity and guidance on recent amendments to Regulation S-P, as well as consideration of changes to ease the compliance burden on covered institutions. The associations cited concerns over overly prescriptive and duplicative requirements, as well as a potential 72-hour notification requirement for service providers, which they argue is too restrictive.

Key Takeaways:

• The American Bankers Association and seven other associations have written a joint letter to the SEC, urging revisions to its data breach standards for investment companies and advisers.
• The associations are seeking increased clarity and guidance on recent amendments to Regulation S-P, citing concerns over overly prescriptive and duplicative requirements.
• The letter proposes revising the 72-hour notification requirement for service providers, allowing for investigation and a reasonable notification period instead.
• The associations also recommended harmonizing the notification requirement with existing standards, and not requiring covered institutions to provide notice to customers with whom they do not have preexisting relationships.
• The effective date of the amendments to Regulation S-P should be delayed by a year to give covered institutions adequate time to prepare for the new requirements.
• The associations aim to promote harmonization between the SEC-proposed rules and rules of other federal agencies, simplify requirements, and protect against cyberthreats without creating enforcement and litigation traps.

Statistics:

• The SEC's data breach standards for investment companies and advisers were adopted in a 2022 amendment to Regulation S-P.
• The associations proposed 10 revisions to the amendments, including the elimination of the 72-hour notification requirement.
• The proposed delay of the effective date would give covered institutions an additional year to prepare for the new requirements.