Skip to content

For RIAs and Wealth Managers

SEC Reg S-P gives you 30 days to notify every affected client after an incident. The clock starts when you become aware of it.

The SEC amended Regulation S-P in May 2024 with a 30-day breach notification window. Many small RIAs have no monitoring on the inbox that holds client statements, account applications, and transfer authorizations. SentinelSMB watches every advisor account around the clock, so the clock starts when the attacker shows up, not weeks later.

Ask about monitoring Run a free scan first
  • Month to month
  • No setup fees
  • Cancel anytime
30 days

Maximum window to notify affected clients under the amended SEC Regulation S-P, in force for larger firms since December 2025 and smaller firms since June 2026

Source: SEC Regulation S-P amendments, 17 CFR 248 (adopted May 2024)

Credentialed, insured, operational

  • RegisteredND LLC
  • IRS registeredEIN on file
  • E&O insured$1M per claim, $2M total
  • EncryptedYour data, at rest and in transit
  • Sign-inAlways a second step
  • Audit trail365-day retention

Threats we catch

Three attacks aimed at RIAs and wealth management firms.

36 detection engines check your Microsoft 365, Google Workspace, AWS and Cloudflare accounts every five minutes. Critical threats surface instantly. Normal activity gets filed away.

ACAT-out fraud and wire redirect

An attacker inside an advisor inbox watches for a pending transfer, then spoofs updated wire instructions to the custodian. Funds leave the client account before anyone verifies by phone.

HNW client list exfiltration

One compromised advisor mailbox exposes every client name, AUM, risk profile, and held-away asset location. Downstream phishing and identity-theft campaigns target your highest-net-worth clients directly.

Account application and TOA theft

Signed account applications, transfer-of-assets forms, and trust documents all move through advisor email. One exfiltration event triggers SEC Reg S-P notification for every individual whose information was accessed.

36 detection engines Every five minutes
ACAT-out fraud and wire redirectFlagged. You get a text with the steps to fix it.

Example alert for a made-up business.

Your blind spot

What a typical IT setup does not watch.

  1. Your advisors work from home offices, coffee shops, and client homes — and every new sign-in pattern looks like an attacker somewhere on earth is trying to get in.
  2. Multi-custodian setups (Schwab, Fidelity, Pershing, Altruist) all authenticate against your email — one hijacked inbox is read access to every custodian portal.
  3. When the SEC Division of Examinations request letter lands, a policy binder is not evidence of actual monitoring. You need real detection logs, real timestamps, real alert history.
  4. Your Chief Compliance Officer probably also wears two other hats and is not going to be the one watching overnight alerts.

The screen is an example for a made-up business, not real customer data.

Compliance alignment

The rules and frameworks we line up to.

SentinelSMB provides the continuous-monitoring, access-control, and incident-response controls these frameworks require. Pro subscribers get the audit-ready evidence package.

  1. SEC Reg S-P (amended 2024)

    30-day customer notification

    The amended Rule 30 requires written notification to affected individuals within 30 days of determining that their sensitive customer information has been accessed without authorization. Continuous monitoring is now effectively required to meet the detection-to-notification timeline.

  2. SEC Rule 206(4)-7

    Compliance program requirements

    Every investment adviser must adopt and implement written policies reasonably designed to prevent violations. Cybersecurity has been an SEC examination priority since 2014 and monitoring is a regular topic in SEC Division of Examinations (formerly OCIE) exam requests.

  3. FINRA Rule 3110

    Supervision of electronic communications

    Broker-dealers and hybrid firms must supervise electronic communications including email and cloud-collaboration tools. Monitoring for unauthorized access to those channels is part of a reasonable supervisory system.

  4. NY DFS 23 NYCRR 500

    Cybersecurity Regulation

    Firms regulated by the New York DFS must comply with 23 NYCRR 500, which mandates specific access-control, audit-trail (500.6), and user-activity monitoring (500.14) controls. SentinelSMB supports the monitoring and logging.

  5. GLBA Safeguards Rule

    Financial institution obligations

    Many financial firms are financial institutions under GLBA. The amended FTC Safeguards Rule (effective June 2023) requires a designated qualified individual, documented incident response, and either continuous monitoring or periodic penetration testing.

Questions

Questions RIAs and wealth management firms ask.

Text Cole at (701) 391-5973
Does SentinelSMB make us Reg S-P compliant?

SentinelSMB provides the continuous-monitoring, detection-timestamp, and audit-trail components the Reg S-P amendment expects. You still need written policies, a designated individual, and documented incident-response procedures. Pro subscribers get the policy-template foundation.

How does this fit with our custodian?

Your custodian secures their own systems. SentinelSMB secures the advisor inbox and cloud accounts that authenticate INTO those custodial systems. Almost every custodial fraud incident starts with a compromise on the advisor side — that is what we cover.

Will this help on an SEC exam?

Yes. Pro subscribers get the Cyber Insurance Evidence Report which documents your continuous monitoring in a format aligned to the cybersecurity topics SEC examiners ask about.

What about our existing cybersecurity RIA or vCISO?

SentinelSMB is complementary — it is the 24/7 monitoring layer your vCISO or cybersecurity RIA does not provide. Most of them focus on policy, program design, and quarterly assessments. We run 36 detection engines against your live accounts every 5 minutes.

Does this cover our Schwab / Fidelity / Pershing integrations?

SentinelSMB monitors the Microsoft 365 or Google Workspace account that signs into those custodian portals. OAuth grants, MFA prompts, and session anomalies leave signals in your email and cloud account — those are what we watch.

The 30-day clock starts when you become aware. We help you find out fast.

You cannot notify on time about access you never noticed. Under 10 minutes to connect, and Pro subscribers get the quarterly evidence report.

Ask about monitoring See pricing