FTC Safeguards Rule compliance for non-bank financial companies means a written information security program under 16 CFR Part 314, the Federal Trade Commission's rule on protecting customer information. It reaches lenders, mortgage brokers, check cashers, wire transferors and other firms with no banking regulator. We build the program around your business, close the technical gaps and prepare documents that stand up to an FTC request.
The rule applies to financial institutions under FTC jurisdiction: businesses engaged in activities that are financial in nature and not subject to another regulator's GLBA enforcement. Section 314.1(b) lists mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors and tax preparers among them.
The list also includes collection agencies, credit counselors and investment advisers not required to register with the SEC. A group fintech set up as a US LLC that handles consumer funds or credit usually sits inside this circle.
The Safeguards Rule is the federal floor. A state licence adds its own layer: a New York DFS licensee also meets 23 NYCRR 500. We write one program that covers both, with a table showing where each control comes from.
Section 314.4 requires a written information security program with nine elements: a Qualified Individual, a risk assessment, safeguards, monitoring and testing, training, service provider oversight, program updates, an incident response plan and an annual report to the board.
Safeguards the rule names directly (314.4(c)):
Without effective continuous monitoring, the firm runs annual penetration testing and vulnerability assessments at least every six months and after material changes. We perform the scanning and assessments; penetration testing is available on request.
The firm designates a Qualified Individual to oversee, implement and enforce the program. That person can be an employee, someone at an affiliate or a service provider; when outsourced, the firm keeps responsibility for compliance.
With an outside Qualified Individual, the firm designates a senior staff member to direct and oversee that provider and requires the provider to keep its own security program (314.4(a)). At least annually the Qualified Individual reports in writing to the board, or to a senior officer where no board exists, on program status, material risks, test results, security events and recommendations (314.4(i)).
We equip the person you designate with the program, risk register, test calendar and an annual report format. An outside Qualified Individual in a vCISO format is available on request.
Since 13 May 2024, a notification event involving the information of at least 500 consumers is reported to the FTC as soon as possible and no later than 30 days after discovery. A notification event is the unauthorized acquisition of unencrypted customer information.
Information counts as unencrypted when the encryption key was accessed by an unauthorized person (314.2(m)). The notice goes through the FTC's online form with the firm's details, the types of information, the date or period of the event and the number of consumers affected (314.4(j)). Discovery dates from the first day any employee, officer or agent other than the perpetrator knew of the event.
The incident response plan under 314.4(h) covers goals, roles and decision authority, communications, remediation, documentation and post-incident review. When the same incident touches EU or Canadian customers, the deadlines stack; we map them on our incident response page.
| Requirement | What it means | Source |
|---|---|---|
| Updated rule requirements apply from 9 June 2023 | The transition is long over; the FTC expects the full set | FTC press release, 15 Nov 2022 |
| A Qualified Individual oversees the program; outsourcing leaves responsibility with the firm (314.4(a)) | A named person, plus oversight of any outside provider | 16 CFR 314.4(a) |
| Written risk assessment with evaluation criteria (314.4(b)) | The program follows from documented risks | 16 CFR 314.4(b) |
| Encryption at rest and in transit; MFA for any access (314.4(c)(3), (5)) | Exceptions only with the Qualified Individual's written approval | 16 CFR 314.4(c) |
| Absent continuous monitoring: annual penetration test, vulnerability assessment every six months (314.4(d)(2)) | The test calendar is part of the program | 16 CFR 314.4(d) |
| FTC notice for events involving 500+ consumers within 30 days (314.4(j)); effective 13 May 2024 | You need a routine to size the event and file the form | 16 CFR 314.4(j), 314.5 |
| Under 5,000 consumers: 314.4(b)(1), (d)(2), (h) and (i) do not apply (314.6) | Every other element still applies to small firms | 16 CFR 314.6 |
Usually, yes. The rule covers businesses engaged in financial activities that no other federal regulator enforces GLBA against. The FTC names lenders, mortgage brokers, account servicers, check cashers and wire transferors. A lawyer gives the final view on your entity; we build the security program the rule requires.
Yes. The rule allows a Qualified Individual employed by an affiliate or a service provider. The firm then keeps responsibility for compliance, designates a senior staff member to oversee the provider and requires the provider to maintain its own security program. We equip the person you designate; an outside Qualified Individual is available on request.
When a notification event involves unencrypted information of at least 500 consumers, the firm files the FTC's online form as soon as possible and no later than 30 days after discovery. Discovery is the first day any employee, officer or agent other than the perpetrator knew of it. The requirement has applied since 13 May 2024.
Firms holding information on fewer than 5,000 consumers are exempt from the written risk assessment, the annual penetration test and six-monthly vulnerability assessments, the written incident response plan and the annual board report. The Qualified Individual, safeguards including MFA and encryption, training, vendor oversight and the FTC breach notice still apply.
Price depends on the number of systems and vendors, the volume of customer data, which policies exist, and whether technical fixes such as MFA and encryption are needed. After a paid 30-minute consultation we set the scope and a fixed price in a scope letter, and follow-up questions on the same documents are included.
One line is enough. A partner reads it and replies in writing within 24 hours.
Or write to hello@innovacg.com
