Regulation S-P makes the advisory firm responsible for overseeing its service providers through due diligence and monitoring, but a firm cannot diligence a party it does not know exists. Of nineteen AI vendors serving financial advisors and RIAs whose public documents we reviewed, eight publish a subprocessor list we could read. Six name a model provider and two name a transcription provider. None names a vector store, the system holding a derived copy of client documents. The one vector database we found named is on Anthropic's own subprocessor list, filed under web search, and three of the nineteen vendors now appear as connectors in Claude for Financial Advisors.
September 23, 2026
Claude for Financial Advisors, released by Anthropic on September 14, 2026, is an openly licensed plugin of eight skills and a twelve-system connector list. The skills are Markdown instructions, the plugin holds no client data, and the repository's own README states that most of its guardrails, including advisor approval before any write to a client system, are enforced by the model following them rather than by the runtime. That makes the plugin a well-written first draft of a firm's AI operating procedures. The controls that hold on a bad day, the record of what happened, and where client documents go when a connector is missing are the firm's to write.
September 19, 2026
Every AI product sold to advisory firms promises that a person approves the work before it counts. Claude for Financial Advisors gates its CRM writes behind a single batch confirmation, and its repository's design rules require a pause before anything leaves the session. The approval happens. The question a firm has to answer is where it was written down. Anthropic's Enterprise audit log records conversations, projects, and file uploads by identifier, and excludes chat content. The closest thing to a recorded approval event is Cowork telemetry an administrator has to configure. Until the firm makes approval an artifact in its own system, the evidence of review is a chat turn.
September 19, 2026
Rule 204-2 (17 CFR 275.204-2) does not mention AI. It lists categories of records an SEC-registered adviser must keep, and an AI-generated document falls into a category, or does not, on the same terms as a human-written one. A sent client email relating to advice is a required record whoever drafted it. An unsent draft usually is not. What AI changes is how much of the work now exists only as unsent drafts and vendor logs, and whether the firm can reconstruct what was sent from what it kept.
September 17, 2026
Under Regulation S-P, a service provider is any entity that "receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution" (17 CFR 248.30(d)(10)). The test is whether records about clients flow to the vendor or are accessible by it, not what the vendor is called, how big it is, or whether it uses AI. Since June 3, 2026, every SEC-registered adviser owes each service provider due diligence, monitoring, and written policies reasonably designed to secure a 72-hour breach notification, and the firm keeps the duty to notify clients itself.
September 16, 2026
Yes, it applies to you. Since June 3, 2026, amended Regulation S-P (17 CFR 248.30) has applied to every SEC-registered investment adviser regardless of size. A firm must maintain written safeguards for customer information, run a written incident response program, notify affected individuals within 30 days of becoming aware of a breach of sensitive customer information, oversee service providers with due diligence and monitoring, and keep records of all of it under Rule 204-2(a)(25). This article walks the rule paragraph by paragraph and ends with what a small firm should do this quarter and what the file should contain.
September 15, 2026
Between August 4 and August 21, 2026, an attacker used a defect in Lenovo's ID registration to sign into roughly 5,000 Dropbox accounts with no password and no access to the victim's inbox. Dropbox says every affected account had two-factor authentication off. For advisory firms that had it on, there was no letter, no investigation, and no Regulation S-P clock. The article explains why a password was irrelevant and a second factor was not, what that one setting spared firms under the amended rule, which second factor to use, and how to require it across every cloud tool that touches client files.
September 1, 2026
Most vendor security questionnaires are long, generic, and produce answers nobody reads. These nine questions are shorter and harder, because each one has an answer that would change whether you sign. They cover the breach-notification clock, where your client data physically goes, whether it trains a model, what you can export, whether the vendor's records satisfy your recordkeeping rule, and who carries the loss. Each question is paired with what a usable answer looks like.
August 12, 2026
The duty to notify clients after a vendor breach sits with the advisory firm, not the vendor. Of nineteen AI vendors serving wealth management whose public documents we reviewed, ten publish a notification deadline, and eight of those ten put it in a data processing agreement, the terms of service, or a subscription agreement rather than the privacy policy. Two name Regulation S-P. Three of the ten deadlines carry qualifiers that change what they mean. The article closes with nine questions a firm can send any vendor.
August 12, 2026
An AI policy states what the firm intends. Exams, arbitrations, and client disputes are settled by evidence of what actually happened. AI work leaves no record unless the workflow is designed to produce one, so the gap between a firm's policy and its receipts is wider than most firms realize.
August 5, 2026
General information from ValaisOS LLC, not legal, compliance, tax, or investment advice. Confirm requirements for your firm with counsel. See Terms of Use.
