Reg S-P Service Provider Oversight for Offshore Teams: What RIAs Should Have on File

Key Takeaways:

• Both Reg S-P compliance dates have passed. Exams now test whether oversight works in practice, not whether a policy exists.

• An offshore staffing partner whose people can access customer information is almost always a "service provider" under the amended rule.

• Reg S-P 72-hour notification lives in your procedures. A contract term is the usual way to meet it, and customer notification stays your responsibility.

• Dedicated, client-directed teams produce a simpler vendor file than pooled models, because people, access, and systems are easier to name.

Both compliance dates for the amended Regulation S-P have passed. Larger firms had to comply by December 3, 2025, and firms with less than $1.5 billion in assets under management by June 3, 2026. Examiners now want proof that controls work in practice, not a policy binder.  

Reg S-P service provider oversight is where many files run thin, because most vendor inventories were built for software and cloud vendors. An offshore team is different. It is people working inside your systems, often in another country.  

This guide shows what an exam-ready file for an offshore team contains, and why the staffing model you choose decides how hard that file is to build.

What is Reg S-P Service Provider Oversight?

Reg S-P service provider oversight is the set of written policies and procedures an SEC-covered institution includes in its incident-response program to assess, monitor, and oversee vendors with access to customer information.

Under the 2024 amendments, these procedures must ensure providers protect customer information and notify the firm as soon as possible, but no later than 72 hours after becoming aware of a breach involving unauthorized access to a customer information system they maintain.  

For offshore operating models, oversight should cover the U.S. contracting entity, offshore delivery centers, employees, subcontractors, and third-party systems.

For example, a U.S. broker-dealer outsourcing customer onboarding to a Manila-based BPO might require:

• Security assessments of the delivery center and remote-work arrangements.

• Encryption, access logging, secure disposal, and breach-notification requirements.

• Role-based access limited to the records needed for onboarding.

• Quarterly reviews of user access and audit logs.

• Annual control attestations or independent audits.

• A clear escalation process that supports 72-hour notification, including Philippine holidays and after-hours incidents.

The broker-dealer remains accountable for its incident response and applicable customer-notification obligations, even when an offshore provider performs the underlying work

What Did the 2024 Reg S-P Amendments Change?

The SEC adopted the amendments on May 16, 2024. They cover SEC-registered investment advisers, including private fund advisers. Private funds may fall under the FTC Safeguards Rule instead, depending on their circumstances. Exempt reporting advisers are not covered institutions under Reg S-P.

Six changes matter most for an RIA:

• Incident response program - written procedures to detect, respond to, and recover from unauthorized access to or use of customer information.

• Customer notification - notice to affected individuals as soon as practicable, and no later than 30 days, when sensitive customer information was or is reasonably likely to have been accessed or used without authorization.

• Service provider oversight - due diligence and monitoring of vendors, including vendor notice to the firm within 72 hours of a qualifying breach.

• Recordkeeping - written records documenting compliance, retained for five years by RIAs, with the first two years in an easily accessible place.

• Broader scope - “customer information” now includes information about the firm’s own customers and customers of other financial institutions whose information the firm receives.

• Disposal - the disposal rule now applies to customer information, not only consumer report information.

For a plain-language summary, start with the SEC's fact sheet on the amendments. The final rule release has the full text.

Is Your Offshore Staffing Partner a "Service Provider" Under Reg S-P?

Almost always, yes. The amended rule defines a service provider as any person or entity that receives, maintains, or processes customer information through services provided directly to the firm. It also covers anyone otherwise permitted access to that information. Affiliates count too.

If offshore staff open client files, reconcile accounts, process transfer paperwork, or update CRM records, the company that employs them meets that definition. An employer of record structure doesn't change the answer. Neither does co-management.

What the model does change is the footprint. Two questions decide it. Whose systems hold the customer data? Which systems does the partner itself maintain? The 72-hour notice requirement is tied to breaches of customer information systems maintained by the service provider. A partner that hosts your data on its own platforms brings more of its environment into scope than one whose staff work inside yours.

Take Connext's co-management model as an example. Connext employs the team through its employer of record infrastructure and handles HR in-country.  

The RIA directs the work and keeps every oversight and compliance decision. Connext is still a service provider under Reg S-P. What changes is how much of the vendor file the RIA can build from its own evidence:

• Named people, not a pool - The team works for one client, and the RIA interviews and approves each hire. The access roster lists real names that don’t rotate.

• Access the RIA controls - Because the team is dedicated, the RIA can set up accounts in its own identity system and run its own access reviews.

• Due diligence evidence on hand - Connext’s SOC 2 Type II report covers all four delivery countries, and background checks run in each one.

• One device process - Work-from-home staff use centrally managed devices, so offboarding follows a single process instead of each person’s personal setup.

None of this shifts responsibility to Connext. It makes the RIA’s own oversight easier to prove.

What Belongs in an Exam-Ready Reg S-P Service Provider Oversight File?

Examiners usually open with a request for core documents. At a January 2026 outreach session, SEC staff said those can include the IT managed service provider contract and org charts showing who oversees what. Staff also said firms may rely on attestations or structured service agreements. For an offshore team, Reg S-P service provider oversight comes down to six parts of the file.

What Should an RIA Vendor Due Diligence Record Include?

• A current SOC 2 Type II report, with its scope checked against the delivery locations your team works from.

• The partner's background-check process for the people assigned to you.

• Information security, acceptable use, and remote-work policies, including how devices are managed.

• A list of subcontractors or affiliates that could touch customer data.

• The date of your review, the reviewer's name, and the conclusion you reached.

A SOC 2 report is strong evidence, but it isn't the whole file. It describes the provider's controls. It doesn't show how your firm reviewed them or what you decided. Our guide to SOC 2 at enterprise scale covers what to look for in the report itself.

How Do You Document Access for Named Offshore Staff?

Examiners will ask who can see customer data. With an offshore team, the strongest answer is a named-user roster tied to your own identity system.

• Each person has a named account in your identity provider, protected by multi-factor authentication.

• Access is role-based and limited to the systems that role needs.

• Access reviews run on a set cadence, with the reviewer and date recorded.

• Offboarding removes access the same day, and the timestamp goes in the file.  

How Should the 72-Hour Notice Requirement Work in Practice?

Your procedures must be reasonably designed to make sure a service provider notifies you as soon as possible after it becomes aware of a breach. The outside limit is 72 hours, and the trigger is unauthorized access to a customer information system the provider maintains.  

The final rule doesn't require a contract to achieve this. In practice, a contract term or written representation is the cleanest evidence an examiner can read.

Whatever form it takes, define four things:

• What starts the clock: awareness of a breach, not confirmation of harm.

• Named contacts on both sides, with backups.

• The notice channel and the minimum facts the first notice must contain.

• How the provider supports your investigation after the first notice.

Then test it. Walk the partner through an incident tabletop exercise once a year and keep the notes. One point to keep straight: a provider can help deliver the 30-day customer notice, but responsibility for that notice stays with your firm.

How Often Should You Monitor a Reg S-P Offshore Vendor?

The rule requires due diligence and monitoring but doesn't set a frequency. A risk-based rhythm that holds up well looks like this:

• Annually - refresh the SOC 2 report and repeat the due diligence review.

• Quarterly - run an access review against the named roster.

• On change - new roles, new systems, a new delivery location, or a headcount change triggers a review.

• Ongoing - keep an incident and exception log, even when it's empty.

Feed the results into your annual compliance program review. Recent law firm guidance notes that examiners look closely at that review and at vendor management documentation.

What Does Disposal Look Like for an Offshore Team?

The amended disposal rule now covers customer information. For an offshore team, disposal is mostly an offboarding event.

• Device return or remote wipe, with written confirmation.

• Removal of local files, downloads, and any printed material.

• Confirmation that the person holds no remaining credentials or tokens.

• A signed or system-generated record kept in the vendor file.

Ask your partner how devices are issued, where the team works, and what happens to equipment when someone leaves. Here’s how that works at Connext:

• Company-issued equipment - Connext provides the hardware each team member uses and monitors it with antivirus software.

• Centrally managed devices for remote staff - Team members who work from home use devices Connext manages centrally.

• Physical controls in the office - Connext offices use biometric door access, lockers for personal electronics, and clean desk policies. Teams with tighter confidentiality needs can request private rooms.

• Round-the-clock IT support - A 24/7 IT operations center monitors equipment uptime and supports the team day to day.

• Independently audited controls - Connext’s SOC 2 Type II report covers security, availability, confidentiality, and privacy controls across all four delivery countries.

These controls support your disposal procedures. They don’t replace them. Your file still needs an offboarding record for each person. Our IT security and equipment page covers the full setup.

Which Records Do RIAs Need to Keep, and for How Long?

RIAs must keep written records documenting Reg S-P compliance for five years, the first two in an easily accessible place. For service provider oversight, the file should hold:

• Your written service provider oversight policies and procedures.

• Documentation of any contract entered into under those requirements.

• Evidence of due diligence and ongoing monitoring, such as risk assessments, vendor questionnaires, SOC report reviews, and access reviews where relevant.

• Incident assessments and your notification decisions.

Dedicated Team or Shared BPO Pool: Which is Easier to Document?

Both models create a service provider relationship. The difference is how much evidence you can produce yourself, and how much you must take on the vendor's word. Here is how the two compare on each part of the file.

| File element | Dedicated, client-directed team | Shared BPO pool |

| Who has access | Named individuals | Rotating agents |

| Where customer data sits | Mostly in the RIA's own systems | Often on the vendor's platforms |

| Access reviews | Per person, in the RIA's identity system | Vendor-reported |

| 72-hour notice scope | Fewer provider-maintained systems | Broader vendor environment |

| Disposal evidence | Per-person offboarding record | Pool-level attestation |

| Org chart for examiners | Team maps into RIA reporting lines | Vendor's own structure |

A dedicated team is still a service provider, and it doesn't shrink your obligations. What it gives you is a file built mostly on evidence from your own systems, which is the kind examiners can test. If you're weighing the two models more broadly, our comparison of dedicated vs. pooled agents covers the operating side.

Why Partner with Connext?

Connext builds dedicated offshore teams for firms that need control, not a pooled seat. Through co-management and employer of record services, Connext supplies the people and the in-country infrastructure. Your firm directs the work, sets access, and keeps every oversight and compliance decision.

• Recruit right - you interview and approve each person who joins your team.

• Manage right - in-country team managers handle HR, attendance, and escalations, so your leaders can focus on the work and the oversight.

• Due diligence support - Connext's SOC 2 Type II report covers all four delivery countries and is available for your review under NDA.

• Delivery centers in the Philippines, Colombia, Mexico, and India, supporting financial services teams at scale.

Ready to build an offshore team your compliance function can document? Book a meeting with our sales team.

Related Reads

• SOC 2 at Scale: What Enterprise Vendor Consolidation Actually Requires

• Connext vs. Traditional BPO

• The Importance of Information Security in Outsourcing

‍