Home / Industries / Financial advisors, insurance & mortgage

IT for firms that hold other people’s money and secrets.

Advisors, agencies and brokers hold account numbers, Social Security numbers and the authority to move money. Regulators expect a written security program and a plan for the bad day. You get both, sized for a small firm.

  • Registered investment advisers and wealth managers
  • Broker-dealer representatives
  • Insurance agencies and independent agents
  • Mortgage brokers and loan originators
  • Title agencies
  • Retirement plan and benefits consultants

What makes financial services IT different

Small financial firms run on a handful of tools: a CRM, custodian or carrier portals, email, e-signature and a lot of PDFs. Most of the sensitive data ends up in email attachments and shared folders, set up years ago by someone who has since moved on.

The rules have tightened. The SEC’s amended Regulation S-P now requires advisers and broker-dealers to keep a written incident response program and to notify affected customers within 30 days, and smaller firms had to comply by June 3, 2026. The FTC Safeguards Rule covers mortgage brokers and other non-bank financial firms, and Michigan’s Insurance Data Security Act covers insurance licensees. Each one asks for roughly the same thing: know your data, protect it, watch it, and have a plan.

Attackers follow the money. FINRA’s 2026 oversight report highlights account takeovers, impersonation and AI-assisted fraud. The defenses are mostly process and configuration, and they’re affordable at small-firm size.

Rules you may answer to

Which of these apply depends on how you’re registered or licensed and what you sell. Sorting that out, in writing, is part of the first assessment.

SEC Regulation S-P
SEC-registered advisers and broker-dealers need written policies to protect customer information, an incident response program, oversight of service providers, and notice to affected customers within 30 days of discovering certain breaches. Smaller firms had to comply by June 3, 2026.
FTC Safeguards Rule
Mortgage brokers, non-bank lenders and investment advisers that aren’t required to register with the SEC need a written information security program, a Qualified Individual to run it, multi-factor sign-in and encryption, and must report breaches of unencrypted data affecting 500 or more people to the FTC within 30 days.
Michigan Insurance Data Security Act
Michigan insurance licensees with 25 or more employees need a written information security program based on a risk assessment. Licensees of any size must notify the Department of Insurance and Financial Services within 10 business days of a cybersecurity event.
GLBA
The Gramm-Leach-Bliley Act is the federal law behind these rules. It also requires privacy notices that tell clients how you share their information.
Michigan breach notification law
Michigan law requires notifying people when certain personal information is exposed, on top of any notice your regulator requires.

Where financial firms get hurt, and how I close the gap

Financial services had the second most expensive breaches of any industry in IBM’s 2026 report. These are the gaps that show up most at small firms, with the numbers behind them and what I do about each.

  1. 30 daysto notify affected customers after discovering certain breaches, under the amended SEC Regulation S-P

    No incident response plan

    Smaller advisers and broker-dealers had to comply by June 3, 2026. You can’t notify the right people in 30 days if you can’t tell what was taken, and the rule requires a written program to work that out.

    What I doA written incident response program sized to your firm, logging that shows what an attacker reached, notice templates ready ahead of time, and a tabletop exercise so the plan isn’t new on the worst day.

    Source: Holland & Knight, Regulation S-P compliance deadline (2026)

  2. 72 hoursfor a service provider to tell you about a breach affecting your customers, under Reg S-P

    Vendors nobody has reviewed

    Your CRM, custodian portal, e-signature, document storage and IT provider all hold client data. The amended rule requires written policies for overseeing them, including prompt breach notice from each one.

    What I doA vendor inventory, a review of how each vendor protects your data, the right contract language, and limits on what each one can reach.

    Source: Parker Poe, takeaways for smaller financial firms (2026)

  3. $6.29Maverage cost of a financial services data breach in 2026, second only to healthcare

    Breaches nobody notices

    Across industries, breaches took an average of 247 days to identify and contain. Every week an attacker sits in a mailbox adds to the bill and to the list of clients who get a letter.

    What I doMulti-factor sign-in, encryption on laptops and phones, alerts on suspicious sign-ins and mailbox rules, and monitoring by someone who actually responds.

    Source: IBM Cost of a Data Breach Report 2026, via Becker’s

  4. 10business days for a Michigan insurance licensee to notify the state after a cybersecurity event

    Agencies without a written program

    Agencies with 25 or more employees need a written information security program based on a risk assessment. The reporting deadline applies to every licensee, whatever its size.

    What I doA risk assessment, a written program that fits your agency, and a reporting playbook so a bad day doesn’t also become a regulatory one.

    Source: Michigan DIFS, Insurance Data Security

  5. 500or more affected consumers triggers an FTC breach notice for mortgage brokers and other non-bank lenders

    Loan files in email attachments

    A loan file is a complete identity kit: pay stubs, tax returns, bank statements and Social Security numbers. The Safeguards Rule expects that data to be encrypted, access-controlled and overseen by a named Qualified Individual.

    What I doSecure upload portals in place of email attachments, encryption everywhere loan files live, multi-factor sign-in, and a written program with someone named to run it.

    Source: FTC, Safeguards Rule: What Your Business Needs to Know

Related services: Network security & cybersecurity · Managed IT services · Microsoft 365 & Google Workspace · Secure AI · Staff training

Where AI helps, and where it needs guardrails

AI can draft the meeting summary, the client letter and the renewal reminder. It can also send a client’s account numbers to a service your compliance policy has never heard of.

Good places to start

  • Meeting summaries and follow-up emails, reviewed before they go out
  • Plain-language explanations of plans, policies and disclosures
  • Newsletters and social posts, routed through your normal compliance review
  • Summarizing carrier, custodian and regulatory bulletins
  • Searching your own procedures and forms with an assistant that stays in your accounts

Keep out of AI tools unless approved

  • Account numbers, Social Security numbers and statements
  • Client financial plans and portfolio details in free or personal tools
  • AI note-takers on client calls without consent and a record-keeping plan
  • Investment or coverage recommendations from AI without your review

How a secure AI setup works

Put AI to work on the files and the follow-up

Advisors, agencies and brokers spend hours pulling numbers out of statements, applications and policies. AI can do the reading. Your judgment and your compliance review stay where they are.

Document reading and data entry

AI that reads statements, applications, declarations pages and loan documents, and fills in your CRM, agency system or loan file for staff to confirm.

What it covers

  • Statements and account documents read into your CRM
  • Policy declarations and renewals compared side by side
  • Loan file documents classified and checked for what’s missing
  • Client meeting notes turned into tasks and follow-ups

Best forFirms where staff retype the same numbers from PDFs every day.

  • Less re-typing
  • Fewer errors
  • Faster turnaround

Fraud and retention signals

Patterns in requests and account activity flagged early: the money movement that doesn’t look right, and the client who’s quietly leaving.

What it covers

  • Unusual money movement and bank-change requests flagged for a call-back
  • Login and contact-detail changes watched for account takeover
  • Clients at risk of leaving, flagged for outreach
  • Renewal and cross-sell timing from your own book

Best forFirms that move client money or live on renewals.

  • Fewer fraud losses
  • Better retention
  • Earlier warnings

How it gets set up

  • Business-tier tools with contracts that cover client data, added to your vendor oversight under Reg S-P or the Safeguards Rule.
  • AI suggests; a licensed person decides. Nothing is sent to a client without review.
  • Logs and records kept to match your books-and-records and supervision obligations.

AI consulting & integration · Agentic operations

Common questions

We’re a small RIA. Does the new Reg S-P apply to us?

If you’re registered with the SEC, yes. Smaller entities, which for advisers means less than $1.5 billion in assets under management, had to comply by June 3, 2026. Advisers that aren’t required to register with the SEC fall under the FTC Safeguards Rule instead, which asks for much the same.

Is multi-factor sign-in actually required?

Under the FTC Safeguards Rule, yes, for anyone accessing customer information. For SEC-registered firms it’s the baseline examiners expect for protecting customer information, and most cyber insurers ask about it before they’ll write a policy.

How do we stop fake wire and distribution requests?

With process as much as technology. Verify every request to move money or change bank details by calling a number you already have, never one in the message. Add multi-factor sign-in on email and client portals, and alerts for suspicious mailbox rules.

Can we use AI note-takers in client meetings?

Often, with care. Get client consent, use a business-tier tool with a contract that covers your data, decide how long transcripts are kept, and confirm your record-keeping obligations before you turn it on.

Sources

  1. Holland & Knight, Regulation S-P compliance deadline (2026)
  2. Parker Poe, takeaways for smaller financial firms (2026)
  3. IBM Cost of a Data Breach Report 2026, via Becker’s
  4. Michigan DIFS, Insurance Data Security
  5. FTC, Safeguards Rule: What Your Business Needs to Know
  6. Mayer Brown, FINRA 2026 Annual Regulatory Oversight Report
  7. Michigan Identity Theft Protection Act, MCL 445.72 (breach notice)

Figures and rules on this page were checked against these sources on October 27, 2026, using the latest edition available. This page is general information, not legal advice.

Other industries

Be ready for the exam and the attacker.

Tell me how your firm runs today. You’ll get a plain-English read on where you stand against the rules that apply to you, and what to fix first.

Book a callSend a message