FTC Safeguards Rule: Who It Applies To and What It Requires
Car dealers, tax preparers, mortgage brokers and lenders are covered by the FTC Safeguards Rule. Here's who it applies to, the 9 required elements and a practical compliance checklist.
The FTC Safeguards Rule requires non-bank financial institutions, including car dealers that arrange financing, tax preparers, mortgage brokers and lenders, to run a written information security program. That means a Qualified Individual, a risk assessment, encryption, MFA, testing, training, vendor oversight, an incident response plan, and FTC notice of breaches affecting 500 or more consumers.
Photo: Unsplash
On this page
A car dealership, a neighborhood tax office and a mortgage broker don’t feel like banks. But to the Federal Trade Commission, all 3 can be “financial institutions,” and that means they must follow the FTC Safeguards Rule, a federal regulation that sets specific security requirements for protecting customer financial information.
The rule was overhauled in recent years, with most new requirements in force since June 9, 2023 and a breach-reporting requirement since May 2024. Many small firms still aren’t sure whether they’re covered or what “compliance” really means. This guide covers both, with a checklist you can work through.
This is general information, not legal advice. Confirm your obligations with your own counsel.
What the FTC Safeguards Rule is
The Safeguards Rule (16 CFR Part 314) comes from the Gramm-Leach-Bliley Act (GLBA), which requires financial institutions to protect customer information. Banks and credit unions answer to their own regulators. The FTC’s rule covers financial institutions under its jurisdiction, which is mostly non-bank businesses that offer financial products or services to consumers.
The FTC first issued the rule in 2003, but the original version was short and flexible. In 2021, the FTC amended it with much more specific requirements, such as multi-factor authentication, encryption and a named person in charge. The FTC extended the compliance date for the main changes to June 9, 2023. A further amendment requiring notice to the FTC for certain security events took effect in May 2024.
Who the rule applies to
The test is whether you’re significantly engaged in financial activities. The FTC’s business guidance lists examples including:
- Mortgage lenders and mortgage brokers
- Payday lenders and finance companies
- Account servicers and check cashers
- Wire transferors and collection agencies
- Credit counselors and other financial advisors
- Tax preparation firms
- Non-federally insured credit unions
- Investment advisors not required to register with the SEC
- “Finders” that bring together buyers and sellers of a product or service
Car dealers
Auto dealers that arrange financing or leasing for customers are engaged in financial activities, which brings most franchised and many independent dealers under the rule. A dealership’s F&I office handles credit applications, Social Security numbers and income data, which is exactly the information the rule protects. Our article on technology in car dealerships covers the systems that typically hold this data.
Tax preparers
The IRS reminds tax professionals that federal law, enforced by the FTC, requires them to create and maintain a written information security plan. The IRS publishes Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, which includes a sample written information security plan (WISP) template for small practices. See our guide to technology in accounting and CPA firms for related tools.
Lenders and brokers
Non-bank lenders, finance companies, mortgage brokers and similar firms are squarely in scope. Many also face state rules, such as state data privacy and financial regulator requirements, which our state privacy laws guide summarizes.
Key takeaway: If you collect financial information from consumers to provide a financial product or service, including arranging a car loan or preparing a tax return, assume the Safeguards Rule applies until you’ve confirmed otherwise.
The 9 required elements
The FTC’s guidance boils the rule down to 9 elements of a written information security program.
- Designate a Qualified Individual to oversee and enforce the program. This can be an employee or someone at a service provider, but your business stays responsible.
- Conduct a written risk assessment of foreseeable internal and external risks to customer information.
- Design and implement safeguards to control the risks you identified.
- Regularly monitor and test whether those safeguards work.
- Train your staff on security awareness.
- Oversee service providers by selecting capable vendors, requiring safeguards in contracts and assessing them periodically.
- Keep the program current as your business, technology and threats change.
- Create a written incident response plan.
- Have the Qualified Individual report to your board or senior leadership at least annually.
The specific safeguards the rule names
Element 3 isn’t open-ended. The rule lists specific safeguards, including:
| Safeguard | What the rule expects |
|---|---|
| Access controls | Limit access to customer information to authorized users who need it |
| Data and system inventory | Know what data you have, where it lives and which systems handle it |
| Encryption | Encrypt customer information on your systems and in transit, or use approved alternative controls if that isn’t feasible |
| Secure development | Use secure practices for in-house apps and evaluate third-party apps |
| Multi-factor authentication | Require MFA for anyone accessing customer information, with equivalent controls only if the Qualified Individual approves them in writing |
| Secure disposal | Dispose of customer information no later than 2 years after you last used it to serve the customer, unless there’s a legitimate business or legal need |
| Change management | Follow procedures when changing systems |
| Monitoring and logging | Monitor and log authorized users’ activity and detect unauthorized access |
| Testing | Continuous monitoring, or annual penetration testing plus vulnerability assessments at least every 6 months |
If you’re unsure about the basics behind some of these, our explainers on encryption, multi-factor authentication and vulnerability scans vs penetration tests cover what each involves.
The small business exception
Financial institutions that maintain customer information on fewer than 5,000 consumers are exempt from 4 specific provisions under 16 CFR 314.6:
- The written risk assessment requirement
- The continuous monitoring or annual penetration testing and semiannual vulnerability assessment requirement
- The written incident response plan
- The annual written report to the board
Everything else still applies, including the Qualified Individual, safeguards like MFA and encryption, training and vendor oversight. Small firms should still assess risk and plan for incidents. The exemption only removes the formal written requirements and testing schedule.
Reporting security events to the FTC
Since May 2024, covered businesses must notify the FTC of a “notification event,” meaning unauthorized acquisition of unencrypted customer information involving at least 500 consumers. The notice must go to the FTC as soon as possible and no later than 30 days after discovery, using the FTC’s online form.
This is separate from state breach notification laws, which may require notifying affected customers and state attorneys general on their own timelines. Your incident response plan should cover both. Our guide to creating an incident response plan walks through the structure.
Compliance checklist
Use this as a working list. Check each item only when it’s done and documented.
Governance - [ ] Qualified Individual named in writing - [ ] Written information security program adopted - [ ] Annual report to owners or board scheduled (if 5,000+ consumers)
Risk and inventory - [ ] Inventory of systems, devices and vendors holding customer information - [ ] Written risk assessment completed (if 5,000+ consumers) and dated
Technical safeguards - [ ] MFA on email, DMS or tax software, CRM, remote access and cloud apps - [ ] Customer information encrypted at rest and in transit - [ ] Access limited by job role, with prompt removal when staff leave - [ ] Activity logging turned on and reviewed - [ ] Secure disposal schedule for paper and digital records
Testing - [ ] Continuous monitoring in place, or annual penetration test and vulnerability scans every 6 months (if 5,000+ consumers)
People and vendors - [ ] Security awareness training for all staff - [ ] Service provider contracts include security requirements - [ ] Vendors periodically reviewed
Incidents - [ ] Written incident response plan (if 5,000+ consumers) - [ ] Process to notify the FTC within 30 days for events affecting 500+ consumers
Where to start if you’re behind
- Name your Qualified Individual this week. If you rely on a managed IT provider, the person can sit there, but someone inside the business should own oversight.
- Inventory customer data. List every system, from your dealer management or tax software to email, file shares, scanners and paper files.
- Turn on MFA everywhere customer data is accessible. It’s one of the most specific requirements and one of the most effective controls.
- Encrypt laptops, backups and email that carry customer information.
- Write the core documents: information security program, risk assessment, incident response plan. Tax firms can start with the IRS Publication 5708 template.
- Review your vendors’ contracts for security terms.
- Schedule testing and training on a recurring calendar.
Many of these steps also satisfy insurers and payment card rules. Our guides to cyber insurance requirements and PCI DSS for small businesses show the overlap.
The bottom line
The FTC Safeguards Rule isn’t just for banks. Car dealers, tax preparers, lenders, mortgage brokers and many other financial services firms must run a written security program with specific safeguards such as MFA, encryption, testing and FTC breach reporting. Start by naming a Qualified Individual, inventorying customer data and turning on MFA, then build out the documents and testing. Those steps protect your customers and your business.
Sources
- FTC: FTC Safeguards Rule, What your business needs to know — covered businesses, 9 elements, specific safeguards and FTC notification
- 16 CFR 314.6 (Cornell LII) — exemptions for institutions with fewer than 5,000 consumers
- FTC: Six-month extension for some Safeguards Rule changes — June 9, 2023 compliance date
- IRS: Careful WISP(er), professional responsibility and data security — tax preparers’ written security plan obligations
Frequently asked questions
Who does the FTC Safeguards Rule apply to?
It applies to financial institutions under FTC jurisdiction, mainly non-bank businesses significantly engaged in financial activities. Examples include mortgage lenders and brokers, payday lenders, finance companies, collection agencies, tax preparation firms, non-SEC-registered investment advisors, check cashers and car dealers that arrange financing or leases. Banks and federally insured credit unions follow their own regulators' rules instead.
Does the Safeguards Rule apply to car dealerships?
Yes, for most dealers. Dealerships that arrange financing or leasing for customers are engaged in financial activities and are treated as financial institutions under the rule. That means they need a Qualified Individual, a written security program, MFA, encryption, testing, staff training and vendor oversight. A dealer that only sells for cash with no financing arrangements should confirm its status with counsel.
Do small tax preparers need a written information security plan?
Yes. The IRS states that federal law, enforced by the FTC, requires tax professionals to create and maintain a written information security plan. Firms with fewer than 5,000 consumers are exempt from some formal requirements, such as a written risk assessment and penetration testing, but still need the plan and core safeguards like MFA. IRS Publication 5708 provides a sample template.
What is a Qualified Individual under the Safeguards Rule?
A Qualified Individual is the person you designate to oversee, implement and enforce your information security program. It can be an employee, an affiliate employee or someone at a service provider such as a managed IT firm. If you use an outside provider, your business remains responsible for compliance and must oversee that person's work and require them to maintain an adequate program.
When do I have to report a breach to the FTC?
You must notify the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted customer information of at least 500 consumers is acquired without authorization. You submit the notice through the FTC's online form. This requirement took effect in May 2024 and is separate from state laws requiring notice to affected customers.
Is there an exemption for small businesses?
Partly. Businesses that maintain customer information on fewer than 5,000 consumers don't need a written risk assessment, continuous monitoring or penetration testing schedule, a written incident response plan or an annual board report. All other requirements still apply, including a Qualified Individual, MFA, encryption, access controls, training and vendor oversight. Counting consumers accurately matters.
What happens if a business doesn't comply with the Safeguards Rule?
The FTC can investigate and bring enforcement actions, which commonly result in orders requiring a security program, outside assessments and years of reporting. Noncompliance also tends to surface after a breach, when it's most costly. Beyond the FTC, state attorneys general, insurers, lenders and manufacturers may also expect proof of compliance. This is not legal advice.
Was this guide useful
No reviews yet. Share your experience and help other readers.
Write a review
Manishdai
Manishdai writes about the technology that is reshaping every industry — from AI agents and cloud platforms to healthtech, fintech and the IT companies building it all across the United States.
manishdai.com