Most business owners hear the words FTC Safeguards Rule and assume it is a banking regulation that has nothing to do with them. That assumption is costing companies real money, because the rule reaches far past traditional banks, and a lot of the businesses it covers have no idea they are on the hook.
Let me walk through who is actually covered, what the rule requires, and how to tell whether it lands on your desk.
What the Safeguards Rule is
The Safeguards Rule comes from the Gramm-Leach-Bliley Act, and it lives in the federal regulations at 16 CFR Part 314. In plain language, it requires financial institutions under the Federal Trade Commission’s jurisdiction to build and maintain a written program that protects their customers’ nonpublic personal information. The Federal Trade Commission overhauled the rule with tougher, more specific requirements that took full effect on June 9, 2023, and then added a breach reporting obligation that went live on May 13, 2024. The catch sits inside that phrase, financial institution.
Financial institution means more than you think
Under this rule, a financial institution is any business significantly engaged in an activity that is financial in nature. That definition sweeps in a long list of companies that would never describe themselves as financial. According to the Federal Trade Commission’s own guidance, covered businesses include mortgage brokers and lenders, motor vehicle dealers that arrange financing, tax preparation firms, payday lenders, collection agencies, retailers that issue their own credit, money transmitters, real estate appraisers, and certain investment advisers. Colleges and universities that participate in federal student aid programs are covered as well.
If your business extends credit, arranges financing, prepares taxes, or handles the financial data of consumers as part of what you do, there is a strong chance the rule applies to you even though you are not a bank. This is the same pattern we see with defense contractors and CMMC, where companies assume a regulation is someone else’s problem right up until it is not. We wrote about that exact trap in our piece on CMMC for subcontractors.
What the rule actually requires
If you are covered, the Safeguards Rule asks for a real security program, not a policy binder that sits on a shelf. The core elements include the following.
- Designating a qualified individual to run your information security program
- A written risk assessment that identifies where customer data is exposed
- Access controls, so people can only reach the data they actually need
- Encryption of customer information both in transit and at rest
- Multifactor authentication for anyone accessing customer data
- Continuous monitoring, or alternatively regular penetration testing and vulnerability assessments
- Security awareness training for your staff
- Written oversight of the outside vendors who handle your data
- A documented incident response plan
- An annual written report to your board or a senior officer
That monitoring requirement is worth sitting with. Detecting unauthorized activity inside your systems is not something you can do with a firewall alone; it takes the kind of continuous monitoring a security operations center provides.
The breach notification clock
Since May 13, 2024, covered financial institutions have to notify the Federal Trade Commission when they discover a notification event, which the rule defines as the unauthorized acquisition of unencrypted customer information affecting at least 500 consumers. The deadline is no later than 30 days after discovery, filed through an online form on the Federal Trade Commission’s website. The agency has said it will publish these reports in a public database, which means a breach becomes a matter of public record that clients, competitors, and plaintiffs’ attorneys can all see.
Thirty days moves fast when you are in the middle of an incident. That is exactly why having an incident response plan and a monitoring partner in place before anything happens is not a luxury.
How to figure out where you stand
Start with one honest question: does my business touch consumers’ financial information as part of how it makes money? If the answer is yes, or even maybe, the next step is a gap assessment that measures your current practices against the rule’s specific requirements. Most businesses we assess are already doing some of what the rule asks and are missing a few pieces that would matter a great deal in an audit or after a breach.
| You do not have to sort this out alone. Our compliance as a service offering is built to map your obligations, close the gaps, and keep you compliant as the requirements evolve, and for many clients it runs alongside their managed IT so security and compliance move together instead of in separate silos. Learn more about our approach to cybersecurity compliance, or reach out through alchanistech.com for a straight answer on whether the Safeguards Rule applies to you. |
Legal disclaimer. This article is provided for general informational purposes only and does not constitute legal advice. Regulatory requirements under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule are complex and fact-specific, and their application depends on your particular circumstances. You should consult qualified legal counsel and review the text of 16 CFR Part 314 before making compliance decisions. Alchanis Technical Services provides cybersecurity and compliance support services and is not a law firm.
