FTC Safeguards Rule for CPA Firms and Mortgage Brokers

A CPA firm in Coral Gables got a call from one of their long-term clients last spring. The client's bookkeeper had just resigned, and on her way out she downloaded three years of client tax files to a personal flash drive. W-2s, Social Security numbers, retirement account statements. The firm's owner had no idea who had access to the client folder or when the permissions had last been reviewed. He also wasn't sure his firm was covered by any breach notification law. He was. The FTC Safeguards Rule had required a written incident response plan since June 2023.

The FTC Safeguards Rule applies to any business that qualifies as a "financial institution" under the Gramm-Leach-Bliley Act. The definition is broader than most owners expect. If your firm provides financial products or services to consumers, whether that's tax preparation, mortgage origination, insurance advice, or payroll services, you likely fall under the rule. That includes sole-practitioner CPA firms, small mortgage broker shops with five loan officers, and independent insurance agencies that store client health and financial data.

The rule's major compliance requirements have been in effect since June 2023. FTC enforcement is not hypothetical: in 2024 the FTC fined a non-bank mortgage servicer $9.1 million for Safeguards Rule violations. Penalties run up to $50,120 per day per violation. Most small financial firms in South Florida have not completed a formal written risk assessment, which the rule explicitly requires.

Key Takeaways

• The FTC Safeguards Rule applies to CPA firms, mortgage brokers, insurance agencies, and tax preparers, not just banks.
• You must designate a qualified individual to oversee your information security program and report to senior leadership at least annually.
• Multi-factor authentication is required for anyone accessing customer financial data, with limited exceptions for documented compensating controls.
• Vendor oversight is a written requirement: you must assess every service provider that handles customer data before signing and on a recurring basis.
• The rule requires a written incident response plan before a breach happens, not after, and the FTC has enforced this against firms with fewer than 50 employees.

Does the FTC Safeguards Rule Apply to Your Firm?

The Gramm-Leach-Bliley Act defines "financial institution" to include any business that is "significantly engaged" in providing financial products or services. The FTC's guidance lists accountants, tax preparers, mortgage brokers, auto dealers, insurance agents, and payroll services as covered entities.

The test is not whether you hold client money. It's whether you collect and store nonpublic personal information, which the rule defines as any information a consumer provides to obtain a financial product or service. A CPA firm storing tax returns qualifies. A mortgage broker storing loan applications qualifies. An insurance agency storing health history for life insurance underwriting qualifies.

The Small Firm Carve-Out

Firms with fewer than 5,000 customer records have a narrower compliance path. If you meet that threshold, you're not required to conduct annual penetration testing or submit a formal written report to your board. You still need a written risk assessment, access controls, encryption, multi-factor authentication, and an incident response plan. The carve-out cuts administrative burden; it doesn't remove the core technical requirements.

Most CPA firms and small mortgage shops don't know which tier they're in. The 5,000-record count is based on customer financial records, not total clients. A 10-person CPA firm serving 300 business clients, each of which has multiple individual W-2 filers, can cross that threshold without realizing it.

What "Financial Product or Service" Means in Practice

If your firm does any of the following, the rule covers you: prepares or files federal or state tax returns, processes payroll, arranges financing or leases, acts as a real estate settlement agent, provides financial planning or investment advice for compensation, or sells or brokers insurance products. That list covers most of what CPA firms, mortgage shops, and independent insurance agencies do day-to-day.

Actionable tip: Pull your client list and count unique individual records that contain Social Security numbers, bank account numbers, or income data. If you're near or above 5,000, have your IT provider document which carve-outs still apply and which full-standard requirements kick in for your firm.

What Your Written Information Security Program Must Include

The rule requires a written information security program, not a verbal policy or a checklist on a shared drive. It has to be a living document, reviewed at least annually, with your qualified individual reporting its status to your board or senior officer at least once a year.

The Qualified Individual Requirement

You need to name someone responsible for your information security program. For firms under 5,000 records, this doesn't have to be a full-time hire. It can be a senior partner, an operations manager, or a managed IT provider acting in a formal advisory capacity. What it can't be is "no one" or "whoever handles the computers."

The qualified individual has specific responsibilities: overseeing your risk assessment process, monitoring vendor compliance, and reporting to senior leadership. If your IT vendor plays this role, your contract should say so, and you should be receiving written updates from them at least quarterly.

The Written Risk Assessment

The rule requires you to identify reasonably foreseeable internal and external risks to customer information and evaluate your existing safeguards. That means asking specific questions: Where is customer data stored? Who has access? What happens when an employee resigns? What's your backup process? Are tax files stored in an encrypted folder or on a local desktop that hasn't been patched in two years?

I sat with the owner of a small mortgage brokerage in Doral last summer and walked through a basic risk assessment for the first time. The biggest gap wasn't technical, it was process. Loan files were stored in a shared OneDrive folder with no access controls, and the folder permissions hadn't been reviewed since 2021. Three former employees still had active accounts. None of this required expensive software to fix, but without anyone assigned to review access permissions, it had gone unaddressed for three years.

Actionable tip: Start your risk assessment with one question: "Who has access to any folder or system containing client Social Security numbers or bank account numbers?" Get a full list of every user, including former employees, and verify each one is still active and still needs that access.

Multi-Factor Authentication and Access Controls

The rule requires MFA for anyone who accesses customer information remotely or through an external network, with one narrow exception: if you document a compensating control that provides equivalent protection. In practice, "we use strong passwords" won't satisfy an FTC examiner.

Access controls go beyond passwords. The rule requires role-based access, meaning employees get access only to the data they need for their specific job. In a CPA firm, that means a bookkeeping staff member doesn't need access to audit workpapers, and a tax preparer doesn't need access to payroll processing records. Most small firms have one folder structure that everyone can see.

Encryption is required for customer information both in transit, meaning email and file transfers, and at rest, meaning stored files on drives and servers. If you're emailing W-2s as unencrypted attachments, or storing them on a local drive with no encryption, both are compliance gaps.

For help building these controls, the GDS compliance management program includes access control reviews and a documented information security program template as part of its standard deliverable for financial services clients.

Vendor Oversight: The Written Requirement Most Firms Skip

If you use any service provider that handles customer information, the rule requires you to assess them before you sign a contract and monitor them on an ongoing basis. That assessment doesn't have to be a formal audit, but it does have to be documented. A vendor's SOC 2 report or a completed security questionnaire counts. A verbal assurance from a sales rep does not.

Think about the vendors most CPA firms use: cloud accounting software, tax preparation platforms, document management systems, e-signature services, payroll processors, and IT support companies. Each one that stores, processes, or transmits customer financial data falls under this requirement.

What to Look for in a Vendor Assessment

For each covered vendor, you need to know three things: where your customer data lives within their systems, what controls they have to protect it, and how they'll notify you if there's a breach. Most enterprise software vendors have a Trust Center or security page that covers the first two. The notification question is a contract term. If your software agreement doesn't specify a breach notification timeline, ask your vendor to add one, or find out if it's covered in their data processing agreement.

Payroll processors deserve special attention. They hold Social Security numbers, bank routing numbers, and wage data for every employee, and they're a frequent target. Run through the same three questions for any payroll vendor and document the answers.

Actionable tip: List every software vendor that stores client data and check whether each has a current SOC 2 Type II report. If a vendor can't produce one on request or hasn't had an audit in the last 18 months, that's a vendor oversight gap worth documenting before your next contract renewal.

Service Provider Contracts and Data Disposal

The rule requires your contracts with service providers to address how they'll protect customer information and how they'll dispose of it when the relationship ends. Most standard software agreements don't address disposal. When you cancel an accounting platform subscription, your client files don't automatically vanish. You need to know the vendor's data retention and deletion policy, and you need it in writing.

This is one of the gaps that shows up in nearly every vendor assessment we run. A firm that's been with a document management platform for five years often has no documented answer to what happens to their client files if the service terminates. If your cyber insurance renewal is coming up, read through what we covered about what RIAs must prove at cyber insurance renewal to see how vendor risk connects to coverage eligibility.

GDS's managed IT program includes vendor contract reviews as part of onboarding for financial services clients, specifically to close this gap before it becomes an audit finding.

Incident Response: What the FTC Expects You to Have Ready

The rule requires a written incident response plan before a breach happens. The plan has to cover how you'll contain the incident, notify affected customers, preserve evidence, and report to the FTC and state regulators where required.

FTC Breach Notification Requirements

As of May 2024, the FTC's updated notification rule requires financial institutions to notify the FTC within 30 days of discovering a breach that affects 500 or more customers. You submit a report through the FTC's online portal. For breaches below that threshold, state laws govern notification timelines, and Florida's breach notification statute (Florida Statute 501.171) requires notification to affected individuals within 30 days of determining a breach has occurred.

Both the 30-day federal and 30-day state clocks are tight. Most small firms that haven't rehearsed their incident response don't meet them. The gap isn't knowledge, it's documentation. When a breach happens, you need to know who to call, what to preserve, and who to notify, without spending the first 48 hours figuring that out.

What Your Plan Has to Cover

An incident response plan for a 15-person CPA firm doesn't need to be a 40-page document. It needs to answer four questions: How will we know when a breach has occurred? Who is responsible for coordinating the response? Who do we notify, and in what order? How do we document what happened?

The notification list is where most plans fall short. It needs to include legal counsel, cyber insurance carrier, the FTC, the Florida Office of Attorney General, and affected customers. Most firms forget the insurance carrier, which is a problem because late reporting can affect coverage. For firms that have already experienced an incident, our post on data breach response for financial advisors and CPA firms covers the notification sequence in detail.

Actionable tip: Write a one-page incident response card with those four questions and keep a copy somewhere outside your normal systems: a printed copy in a desk drawer or a contact card saved in your phone. If your network is compromised, you may not be able to access your cloud documentation.

If you want to see where your current controls stand against what the FTC's standard requires, a free IT and compliance assessment from GDS will walk through each requirement and identify the gaps specific to your firm size and data environment.

Frequently Asked Questions

Does the FTC Safeguards Rule apply to CPA firms that only do tax returns?

Yes. The FTC's guidance names tax preparers and filers as covered financial institutions. If you store client Social Security numbers, W-2s, or bank account information in connection with tax preparation, the rule applies. The small firm carve-out reduces some administrative requirements for firms under 5,000 records, but the core technical safeguards still apply.

What counts as "customer information" under the rule?

Any nonpublic personal information a consumer provides to obtain a financial product or service from you. That includes names, Social Security numbers, bank account and credit card numbers, income data, and any information in a consumer report. It also covers derived data: a spreadsheet your staff built from client-provided data is still covered, even if it doesn't contain Social Security numbers directly.

We use a cloud accounting platform. Does that count as being compliant?

Using a secure platform is one control, not a compliance program. The rule requires you to assess your vendor's security posture, ensure the contract covers data protection and disposal, and document that assessment. It also requires controls on your own side: access management, MFA for anyone accessing the platform remotely, and a documented process for removing access when employees leave.

How does the FTC Safeguards Rule relate to SEC cybersecurity rules for RIAs?

Registered investment advisers are primarily regulated by the SEC for cybersecurity, and the SEC's cybersecurity rules overlap with many Safeguards Rule requirements. If you're an RIA also doing tax prep or insurance advisory services, you may have obligations under both frameworks. The SEC and FTC do not coordinate enforcement, so a gap that satisfies one agency may not satisfy the other. The GDS cybersecurity program addresses both frameworks for firms carrying dual obligations.

What's the first step if we've never done a formal risk assessment?

Start with a data inventory: every location where customer financial information is stored, who has access, and how it's protected. That covers cloud platforms, local drives, email accounts, and any portable storage. Once you have the inventory, you can compare each location against the Safeguards Rule's minimum controls and document the gaps. Most firms can complete a working first draft in a half-day with the right IT support.

Ready to Find Out Where Your Firm Stands?

The FTC Safeguards Rule doesn't require perfection. It requires a documented, active program with specific technical controls in place. For most CPA firms and mortgage shops, the gap between where they are and where they need to be is a few months of focused work, not a full compliance department. The question is whether you close that gap before the FTC looks or after.

GDS works with financial services firms across South Florida to build written information security programs, conduct formal risk assessments, and set up the access controls and vendor oversight documentation the rule requires. Request a free IT and compliance assessment and we'll walk through exactly where your firm stands against the Safeguards Rule's current requirements.