Your firm knows the notification timelines and policy requirements for amended Regulation S-P requirements — but do you know how to identify vendors correctly? And do you know how many you really have?
While Reg S-P focuses on service providers with access to customer information, many firms are managing double or even triple as many vendors as they think they are. This gap exposes firms already subject to the rule to immediate compliance risk. For firms approaching the June deadline, it's a critical planning error that could derail their compliance strategies.
Here's why firms consistently undercount their vendor relationships, and how to build a complete inventory before examiners come calling.
Related: Understanding the SEC’s Regulation S-P Vendor and Incident Response Requirements
Why complete vendor identification matters
You can't build policies, negotiate contracts, or pass examinations with an incomplete vendor inventory.
While amended Regulation S-P specifically addresses service providers with access to customer information, maintaining separate tracking systems for "covered" versus "non-covered" vendors creates blind spots. A unified approach to service provider governance isn't just efficient — it's essential risk management.
Related: What is Vendor Management? Processes, Best Practices, and Challenges
What is a Service Provider?
Under Reg S-P, the term “service provider” captures virtually any third-party relationship that touches client data. Throughout this document, “vendor” and “service provider” refer to third parties.
The goal is to fully understand your third-party ecosystem. If you think your firm uses 30 service providers, the actual number is likely over 100. Why? Because every individual relationship counts separately, and the definition extends far beyond your core technology stack.
The vendor multiplication effect
Let’s say your firm engages ten sub-advisers for specialized expertise across different strategies. In last year's vendor inventory, you might have listed "sub-advisers" as a single line item.
Under amended Reg S-P, that's not one service provider — it's ten separate service providers, each requiring individual assessment and ongoing oversight. This multiplication effect cascades through your entire service provider ecosystem.
High-multiplication categories (5+ service providers)
Pay special attention to categories where you typically engage multiple providers, such as:
- Research providers: Economic research, equity research, fixed income research, alternative investment research (Each provider counts separately.)
- Custodians and sub-custodians: Every custody relationship is distinct
- Fund administrators: Each administrator for different fund structures
- Trading platforms: Each execution venue and platform
- Data feeds and terminals: Every financial data provider subscription
- Law firms: Securities counsel, employment law, regulatory counsel (Each firm counts separately.)
- Sub-advisers: Each relationship is a separate service provider
These categories alone can add 30-50 individual service providers to your inventory that might previously have been grouped as single line items.
Often-overlooked service providers
Your service provider review should also include categories often overlooked. Based on real-world vendor inventories, here are service providers you're probably not counting:
Technology infrastructure
- API providers and data feeds (each connection counts separately)
- Email and text/SMS message archiving services (separate from your email provider)
- Virtual data room providers
- Client portal platforms (separate from custodian portals)
- E-signature services
- Password managers and authentication services
- Website hosting and domain registrars
- Search Engine Optimization (SEO) and website analytics tools
Professional services
- Compliance consultants who review client files
- Accountants and tax preparers handling client tax documents
- Law firms that access client agreements
- Marketing agencies creating targeted campaigns
- Public relations firms managing communications
- Event planners who handle client names, dietary preferences, and contact information for appreciation dinners or conferences
- Expert networks providing investment research
- Background check and verification services
Operations and administration
- Outsourced CFO or bookkeeping services
- Payroll processors
- Benefits administrators (retirement plans, health insurance)
- Corporate credit card providers
- Expense management platforms
- Travel booking services
- Virtual receptionist and answering services
- Transcription and minute-taking services
- Webinar platforms that store attendee registration data
- Conference call services for board meetings that maintain participant lists and potentially recordings
Physical world service providers
- Office cleaning services with after-hours access
- Document storage and management companies
- Shredding and secure disposal services
- Office equipment maintenance (every device from phones to copiers — many store data you've forgotten about)
- Building security and access control systems
- Backup power and disaster recovery facilities
Investment operations
- Trading platforms and execution venues
- Proxy voting services
- Corporate action processors
- Securities lending agents
- Transition managers
- Risk management and analytics platforms
- Performance attribution systems
- Trade order management systems
Affiliate and referral relationships
- Affiliated advisers with access to client information
- Solicitors and referral partners who receive client information
How to build a complete vendor inventory
As client and regulator expectations evolve, third-party risk management (TPRM) becomes a continuous obligation — not a once-a-year exercise. Firms will spend more time on TPRM over time, and the choices eventually narrow: add dedicated headcount, implement a vendor management system that does the heavy lifting, or accept the regulatory and client consequences of doing neither. Scalable systems free firms to focus oversight on risk impact — not SOC report technicalities or discovering too late that a vendor incident triggered Regulation S-P obligations.
Building a complete vendor inventory requires a systematic approach:
Establish your baseline
Remember, every external entity your firm engages with, whether you pay them or not, is a potential service provider. Compensation doesn’t define a service provider relationship — access does.
Create a tracking sheet
Create a comprehensive list with these columns:
- Service Provider Name (the specific entity, not the category)
- Service Category (from the examples above)
- Data Types Accessed (NPI, financial, contact, etc.)
- Access Method (direct system access, file transfer, physical access)
- Oversight Measures (how you monitor this vendor)
- Contract Status (when last reviewed for data protection terms)
- Incident Response Contract (who to call in a breach)
List vendors individually
Don't group service providers by type. List each one individually. Those five different research providers? Five separate rows. The three custodians? Three distinct entries.
Plan for ongoing maintenance
Every vendor change, every contract renewal, every new service added, every contact update — each requires immediate attention. Add quarterly reviews, annual assessments, and incident response updates, and that spreadsheet becomes a full-time job. Manual tracking quickly becomes unsustainable when you're managing dynamic vendor relationships at scale. That’s where automated vendor risk and compliance software comes in, helping firms manage vendor risk, from onboarding to termination.
Related: TPRM 101: What is Ongoing Vendor Monitoring for Financial Institutions?
How incomplete inventories create operational risk
An incomplete vendor inventory doesn't just create compliance gaps — it creates operational blind spots that can cascade into crisis.
When a vendor experiences a breach, Reg S-P gives you 72 hours to learn about it and 30 days to notify clients. But if that vendor isn't in your inventory, they likely don't have contractual notification requirements. They might investigate quietly for weeks while you remain unaware. By the time you discover the breach, your notification window has closed, and your clients' data has been exposed.
Related: How to Respond When a Vendor Gets Hacked
Your four-week vendor discovery plan
Whether you're validating an existing inventory or building one from scratch, here's a systematic approach to uncover the vendors you've been missing:
Week 1 (4-6 hours): Export your accounts payable list, but don't stop there. Many service provider relationships — free tools, trial services, reciprocal arrangements — won't appear on any invoice.
Week 2 (6-8 hours): Survey department heads. Each team uses tools and services that procurement might not track. Ask specifically about: collaboration tools, research subscriptions, professional services, event vendors, and data services.
Week 3 (4-6 hours): Review system access logs. Identify every third party with login credentials to any system. Include email accounts, CRM access, cloud storage, and administrative portals.
Week 4 (8-10 hours): Map data flows. Trace client information from intake through disposal, identifying every touchpoint. This exercise often reveals vendors you'd completely forgotten about.
For firms approaching the June 2026 deadline, starting this discovery process now gives you time to identify vendors, negotiate contract amendments, and update policies before compliance is required.
Moving forward
The question isn't whether you need to expand your service provider inventory. It's whether you'll discover the gap through your own review or during an SEC examination.
Remember: every service provider counts individually — and you definitely have more than you think.
Is your service provider inventory exam-ready? Download our free self-assessment checklist to uncover Reg S-P gaps in your vendor management program.
