Your firm knows the notification timelines and policy requirements for amended Regulation S-P requirements — but do you know how to identify vendors correctly? And do you know how many you really have?
While Reg S-P focuses on service providers with access to customer information, many firms are managing double or even triple as many vendors as they think they are. This gap exposes firms already subject to the rule to immediate compliance risk. For firms approaching the June deadline, it's a critical planning error that could derail their compliance strategies.
Here's why firms consistently undercount their vendor relationships, and how to build a complete inventory before examiners come calling.
Related: Understanding the SEC’s Regulation S-P Vendor and Incident Response Requirements
You can't build policies, negotiate contracts, or pass examinations with an incomplete vendor inventory.
While amended Regulation S-P specifically addresses service providers with access to customer information, maintaining separate tracking systems for "covered" versus "non-covered" vendors creates blind spots. A unified approach to service provider governance isn't just efficient — it's essential risk management.
Related: What is Vendor Management? Processes, Best Practices, and Challenges
Under Reg S-P, the term “service provider” captures virtually any third-party relationship that touches client data. Throughout this document, “vendor” and “service provider” refer to third parties.
The goal is to fully understand your third-party ecosystem. If you think your firm uses 30 service providers, the actual number is likely over 100. Why? Because every individual relationship counts separately, and the definition extends far beyond your core technology stack.
Let’s say your firm engages ten sub-advisers for specialized expertise across different strategies. In last year's vendor inventory, you might have listed "sub-advisers" as a single line item.
Under amended Reg S-P, that's not one service provider — it's ten separate service providers, each requiring individual assessment and ongoing oversight. This multiplication effect cascades through your entire service provider ecosystem.
Pay special attention to categories where you typically engage multiple providers, such as:
These categories alone can add 30-50 individual service providers to your inventory that might previously have been grouped as single line items.
Your service provider review should also include categories often overlooked. Based on real-world vendor inventories, here are service providers you're probably not counting:
As client and regulator expectations evolve, third-party risk management (TPRM) becomes a continuous obligation — not a once-a-year exercise. Firms will spend more time on TPRM over time, and the choices eventually narrow: add dedicated headcount, implement a vendor management system that does the heavy lifting, or accept the regulatory and client consequences of doing neither. Scalable systems free firms to focus oversight on risk impact — not SOC report technicalities or discovering too late that a vendor incident triggered Regulation S-P obligations.
Building a complete vendor inventory requires a systematic approach:
Remember, every external entity your firm engages with, whether you pay them or not, is a potential service provider. Compensation doesn’t define a service provider relationship — access does.
Create a comprehensive list with these columns:
Don't group service providers by type. List each one individually. Those five different research providers? Five separate rows. The three custodians? Three distinct entries.
Every vendor change, every contract renewal, every new service added, every contact update — each requires immediate attention. Add quarterly reviews, annual assessments, and incident response updates, and that spreadsheet becomes a full-time job. Manual tracking quickly becomes unsustainable when you're managing dynamic vendor relationships at scale. That’s where automated vendor risk and compliance software comes in, helping firms manage vendor risk, from onboarding to termination.
Related: TPRM 101: What is Ongoing Vendor Monitoring for Financial Institutions?
An incomplete vendor inventory doesn't just create compliance gaps — it creates operational blind spots that can cascade into crisis.
When a vendor experiences a breach, Reg S-P gives you 72 hours to learn about it and 30 days to notify clients. But if that vendor isn't in your inventory, they likely don't have contractual notification requirements. They might investigate quietly for weeks while you remain unaware. By the time you discover the breach, your notification window has closed, and your clients' data has been exposed.
Related: How to Respond When a Vendor Gets Hacked
Whether you're validating an existing inventory or building one from scratch, here's a systematic approach to uncover the vendors you've been missing:
Week 1 (4-6 hours): Export your accounts payable list, but don't stop there. Many service provider relationships — free tools, trial services, reciprocal arrangements — won't appear on any invoice.
Week 2 (6-8 hours): Survey department heads. Each team uses tools and services that procurement might not track. Ask specifically about: collaboration tools, research subscriptions, professional services, event vendors, and data services.
Week 3 (4-6 hours): Review system access logs. Identify every third party with login credentials to any system. Include email accounts, CRM access, cloud storage, and administrative portals.
Week 4 (8-10 hours): Map data flows. Trace client information from intake through disposal, identifying every touchpoint. This exercise often reveals vendors you'd completely forgotten about.
For firms approaching the June 2026 deadline, starting this discovery process now gives you time to identify vendors, negotiate contract amendments, and update policies before compliance is required.
The question isn't whether you need to expand your service provider inventory. It's whether you'll discover the gap through your own review or during an SEC examination.
Remember: every service provider counts individually — and you definitely have more than you think.
Is your service provider inventory exam-ready? Download our free self-assessment checklist to uncover Reg S-P gaps in your vendor management program.