SSI Fraud on a T+1 Clock and the New Regulation S-P

Illustration of a bronze bull walking toward the viewer between two lines of people in dark suits

Updated October 2026, after the Regulation S-P compliance dates. First published March 2024.

The 2024 version of this post said T+1 called for a "cyber fortress." The specific risk is narrower and more practical than that. When a trade settles the next day, a request to change where the cash or securities go arrives with less time to check it. Business email compromise is built to use that pressure, and since 2024 the SEC's Regulation S-P has set out what a broker-dealer must do when a scheme like this reaches customer data.

The Scheme

FinCEN describes email compromise fraud as schemes in which criminals compromise email accounts to send fraudulent payment instructions to financial institutions or business associates, in its advisory FIN-2019-A005 of July 16, 2019. In the FBI's 2025 Internet Crime Report, business email compromise drew 24,768 complaints and $3.05 billion in reported losses. Among cyber-enabled frauds, only investment fraud lost more.

In settlement, the target is the standing settlement instruction (SSI). A message that appears to come from a client, a custodian, or a counterparty asks you to change an account number, a DTC participant number, or the bank for the cash leg. The FinCEN advisory notes that such transfers are often irrevocable, so the money can't be recalled once it's gone.

Why a One-Day Cycle Makes It Harder

The Financial Markets Standards Board's Standard for Sharing of Standard Settlement Instructions (version 2, September 2026) puts the problem plainly. SSIs shared by email, phone, or fax need manual handling, which increases "the opportunities for error, fraud." They often have to be confirmed by a call-back to the counterparty, and the call-back becomes a bottleneck when SSIs are exchanged close to settlement. The standard also lists incorrect or missing SSIs as the most significant cause of settlement fails after lack of inventory.

Under T+1, close to settlement can mean the same evening. Investment managers often allocate after the close, and DTC's affirmation cutoff is 9:00 p.m. ET. A request that says the instruction has to change before tomorrow's settlement is asking you to skip the call-back.

Controls That Fit a One-Day Window

Keep SSIs on an authenticated platform where you can. FMSB's first core principle says SSIs should be entered and managed in electronic solutions that allow standardization and pre-authentication. DTCC's ALERT database is one such platform, and our post on SSIs and DTCC ALERT covers how it works.
Never act on a changed instruction using the contact details in the message that requested it. Call back on a number you already had on file. FinCEN suggests verifying emailed payment instructions "by using multiple means of communication or by contacting others authorized to conduct the transactions."
Require a second person to approve any SSI change, and log who approved it and how it was verified.
Collect SSIs at onboarding. FMSB's third principle says all SSIs expected to be used should be shared when the account or product is onboarded, so a change near trade date is an exception.
Send any SSI change requested for a trade settling the next day to a supervisor, even if waiting means the trade fails. A fail can be fixed the next day. A payment to the wrong account often can't be recalled.

FMSB chose not to set a standard for call-backs, calling them a matter of the recipient's risk tolerance, and it noted that current technology "does not provide infallible security." For changes requested close to settlement, we'd set that tolerance at zero.

What Regulation S-P Now Requires

If the attacker got into a mailbox, the incident doesn't end with the payment. The SEC adopted amendments to Regulation S-P on May 16, 2024. Broker-dealers, among other covered institutions, must have written policies and procedures for an incident response program that detects, responds to, and recovers from unauthorized access to or use of customer information. The program must include notice to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice is due as soon as practicable and no later than 30 days after the firm becomes aware of the incident. Firms must also require their service providers to notify them within 72 hours of becoming aware of a breach.

The amendments were published in the Federal Register on June 3, 2024. Larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026, as FINRA reminded member firms. For broker-dealers, "larger" means any firm that isn't a small entity under the Exchange Act definition used for the Regulatory Flexibility Act. Both dates have passed, so every broker-dealer should now have the program in place.

For a compromised operations mailbox, the program has to answer more than whether money moved. It has to establish whether the attacker could read messages holding customer account details, and whether that triggers notice. Our post on GDPR, CCPA, and Regulation S-P covers which privacy laws reach a U.S. broker-dealer.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.