The Securities and Exchange Commission's (SEC) fiscal year ends September 30. That deadline has a way of accelerating activity, including the issuance of sweep letters.
As of June 3, 2026, all covered institutions are required to comply with amended Regulation S-P. Smaller firms just joined larger firms, which have been subject to the rule since December 2025. Every covered RIA and broker-dealer is now on the hook.
If your vendor management program can't withstand a close look at your due diligence documentation and oversight structure, now is the time to find that out, not after a letter arrives.
Related: Amended Reg S-P Guide
A sweep letter is a targeted, industry-wide information request, not a full exam. After a rule change or amendment, such as Regulation S-P, the SEC's Division of Examinations typically sends a standardized set of questions to a broad cross-section of registrants to see how the industry is implementing it. A small subset, based on what their answers reveal, gets escalated to a more targeted examination.
The letter does more than sort firms into buckets, however. Responses build the SEC's picture of industry-wide compliance, and that picture can shape where future exam priorities land.
While the SEC doesn’t publish its criteria for sweep letters, a few common items tend to draw attention, such as a recently updated Form ADV, new service providers in the past year, or any reported incident involving client data.
How you answer matters as much as what you answer. Vague or inconsistent responses are what move a firm from the general pool into a closer look.
Vendor oversight is a prominent focus area in the SEC's 2026 Examination Priorities, and Reg S-P sits right at the center of it. Topics that show up in the Division of Examinations' published priorities often surface in sweep letters as well.
This isn't the SEC's first time flagging vendor oversight under Reg S-P, either. A 2019 risk alert, issued under the version of the rule in effect before the 2024 amendments, found firms with policies that required vendors to contractually safeguard customer data, but that hadn’t followed up to confirm those agreements were in place.
The amended rule has changed since then, but the underlying issue — having a policy on paper without enforcing it — is the same one examiners would likely be watching for now.
SEC-registered investment advisers and broker-dealers are squarely in scope, as both smaller and larger firms are now subject to the amended requirements.
Related: The SEC's Regulation S-P Vendor and Incident Response Requirements
Based on how sweep letters have worked in past cycles and what Reg S-P requires, here are a few questions that may show up:
A complete vendor inventory matters more than firms expect. If a relationship is missing from your records, that oversight surfaces the moment an examiner asks for documentation you don't have. And collecting a SOC report isn't the same as reviewing one. Examiners want to see that someone evaluated the findings, not just filed the report.
Reg S-P also sets the clock running on incident response: service providers must notify covered institutions within 72 hours of a breach, and covered institutions must notify affected customers within 30 days. Firms need a documented process for what happens in between.
The last question is the one that catches firms off guard: who reviews the due diligence work, and is that person independent from whoever did it? Picture a single compliance officer who builds the vendor questionnaire, sends it, collects the responses, and is also the only one who signs off on what came back. That's a self-supervision problem, and examiners are trained to spot it. Oversight must be evidenced, not just described.
Related: Save hours on contract reviews and better understand vendor contracts with AI-powered vendor contract management software. Learn more.
You can't control if your firm gets a sweep letter. You can control how ready your vendor management program is when it arrives.
Firms that take an honest look at their documentation, vendor inventory, and oversight structure now are in a stronger position than those who don't. That's true whether a letter ever arrives.
Not sure where your program stands? Our Reg S-P self-assessment tool helps you take a clear, practical look at your program, so you can find the gaps before your next exam.