SEC Reg S-P WIRP Deadline: June 3, 2026 for Broker-Dealers
The SEC's amended Regulation S-P (Rule 248.30) created a new requirement that all registered broker-dealers must adopt and implement a Written Incident Response Program (WIRP) for unauthorized access to customer information.
Larger broker-dealers (those with $1B+ in assets under management) had a deadline of December 3, 2025. Smaller broker-dealers have until June 3, 2026 — just two months away.
What Is a WIRP?
A Written Incident Response Program is a formal, documented plan for:
- Detecting unauthorized access to or use of customer information
- Assessing the nature and scope of any incident
- Containing and controlling the incident
- Notifying affected individuals within required timeframes
- Coordinating with law enforcement and regulators when appropriate
This isn't optional guidance. It's a legally mandated written program that SEC examiners will review during routine examinations.
Who Must Comply by June 3, 2026?
Every SEC-registered broker-dealer that wasn't covered by the December 2025 deadline for larger firms. This includes:
- Small and mid-size broker-dealers
- Introducing brokers (even those that don't custody assets)
- Dually-registered broker-dealer/investment advisers (the BD component)
- Limited purpose broker-dealers
If you file Form BD with the SEC, you need a WIRP by June 3, 2026.
What SEC Examiners Will Look For
Based on the SEC's Division of Examinations priorities and enforcement history:
- Written documentation — verbal plans don't count
- Board or senior management oversight — who approved the program?
- Specific notification procedures — how will you notify customers within the required timeframe?
- Incident classification criteria — how do you determine what qualifies as an incident?
- Testing and updating — have you tested the plan? When was it last updated?
- Third-party service provider oversight — does your program cover vendor incidents?
The Penalty Reality
SEC enforcement actions for Reg S-P violations have resulted in penalties ranging from $50,000 for small firms to multi-million dollar settlements for larger violations. The 2024 amendments signal the SEC takes customer data protection seriously.
More importantly, an SEC examination finding of "no WIRP" creates a deficiency letter that must be remediated — often under a tight timeline and while under examiner scrutiny.
Generate Your BD WIRP
BDWIRPKit generates a complete SEC Reg S-P Rule 248.30 Written Incident Response Program tailored to your broker-dealer's size, operations, and risk profile.
$199.99 per program. No subscription.
63 days until the June 3 deadline. SEC examiners will be asking for your WIRP.