Financial institutions ordered to notify customers after a breach, have an incident response plan

The SEC adopted amendments to Regulation S-P requiring registered broker-dealers, investment companies, advisers, and transfer agents to maintain written incident response policies and to notify customers within 30 days of discovering a breach involving customer information; notices must include incident details, data affected, and steps customers can take. The rule takes effect 60 days after Federal Register publication, with 18 months for larger entities and 24 months for smaller ones to comply, aiming to strengthen protection of consumer financial data amid rising identity theft.