The FTC Safeguards Rule applies to any business the FTC considers a financial institution, a category that includes mortgage brokers, car dealerships, tax preparers, collection agencies, and many companies that never think of themselves as financial companies at all. A small business exception exists for companies holding information on fewer than 5000 consumers, but it only removes a few specific requirements rather than the rule itself. Businesses already regulated by another federal agency, such as banks and federally insured credit unions, are excluded, but everyone else with access to consumer financial nonpublic personal information should assume the rule applies until proven otherwise.
When business owners hear about the FTC Safeguards Rule, many assume it does not apply to them. It sounds like a rule written for banks, not for a car dealership, a tax office, or a local financing company.
That assumption is one of the most common and most costly misunderstandings in small business compliance. The FTC’s definition of financial institution is much broader than the name suggests, and it was built to reach exactly the kinds of businesses that assume they are exempt.
In this article, you will learn how the FTC defines a financial institution, which businesses are commonly surprised to find themselves covered, who is genuinely exempt, and what compliance looks like once you know where your business stands.
What the FTC Safeguards Rule Is Designed to Do
The Safeguards Rule was created under the Gramm Leach Bliley Act, a federal law passed in 1999 to protect the privacy and security of consumer financial information. Its purpose is straightforward. If a business has access to sensitive customer financial data, it needs a reasonable plan to protect it.
The rule took effect in 2003, but the FTC significantly updated it in 2021 to reflect how technology and data risk have changed since then. Covered businesses now need concrete practices in place, not just a general policy sitting untouched in a drawer.
Who the Rule Defines as a Financial Institution
The FTC does not define a financial institution the way most people would expect. Instead of focusing on industry labels, the rule looks at whether a business is engaged in activity that is financial in nature and handles non-public personal information. That includes lending money, arranging financing, collecting debts, preparing taxes, and several other everyday business functions.
The FTC has published examples to make this clearer. Mortgage brokers, tax preparation firms, real estate appraisers, collection agencies, check cashers, credit counselors, and investment advisers not required to register with the SEC are named directly as covered financial institutions.
Businesses Often Surprised to Qualify
Car dealerships are one of the clearest examples. Any dealership that arranges financing for customers, even occasionally, is very likely covered. Retailers that offer their own financing or payment plans fall into the same category, along with payday lenders and other small dollar lenders.
The common thread is simple. If your business regularly touches customer financial information such as loan applications, payment histories, or account details, the FTC likely considers you a financial institution, regardless of what industry you think you belong to.
Who Is Exempt From the Rule
Exemption is not about size, reputation, or industry perception. It is about who already regulates you. The Safeguards Rule does not apply to financial institutions that are already subject to enforcement by another federal regulator.
In practice, this means banks, federally insured credit unions, and SEC registered investment advisers are excluded from the FTC’s version of the rule because another agency already holds them accountable for similar protections. Everyone else should assume the rule applies unless they can point to that specific carve out.
The Small Business Exception, and Why It Is Not a Full Pass
The FTC does include a narrower exception for businesses that maintain information on fewer than 5000 consumers. It is worth understanding exactly what it covers, because many business owners misread it as a full exemption.
Qualifying small businesses are excused from a handful of specific requirements, including a written risk assessment, a written incident response plan, annual reporting to a board or governing body, and continuous monitoring or periodic penetration testing. Every other core requirement of the rule still applies.
It is also easier to exceed that 5000 consumer threshold than most business owners expect. Standard record retention alone can mean a company is holding two or more years of customer records at any given time, well beyond what its current active customer count would suggest.
What Compliance Actually Involves
For a covered business, the core requirements are practical rather than exotic. They include a written information security program, one qualified individual designated to oversee it, a risk assessment that identifies where customer data lives and how it could be exposed, and safeguards that match those risks, like cybersecurity awareness training, controls etc.
A 2023 amendment added a newer requirement. Covered businesses that experience a breach affecting 500 or more people must report it to the FTC within 30 days of discovery. That requirement applies on top of the existing security program obligations.
What Happens If a Covered Business Ignores the Rule
The FTC has authority to pursue enforcement action against businesses that fail to meet the rule’s requirements, and violations can lead to consent orders, ongoing oversight, and financial penalties. Beyond the direct cost, a breach at a business with no documented security program is a much harder story to recover from with customers and partners.
None of this is designed to be punitive for its own sake. The rule exists because customer financial data carries real risk when it is mishandled, and a reasonable security program is the most direct way to reduce that risk.
Conclusion
Whether the Safeguards Rule applies to your business comes down to what you do, not what you call yourself. Mortgage brokers, dealerships, tax preparers, collection agencies, and many other everyday businesses meet the FTC’s definition of a financial institution even when nothing about their name suggests it.
The small business exception can soften a few specific requirements, but it does not remove the rule altogether, and it is easy to underestimate how many customer records a business is actually holding. The safest starting point is an honest look at what customer financial data your business touches and how it is currently protected.
If you are not sure whether the rule applies to your business, or you know it does and want a clear path to a reasonable security program, let’s talk through what you currently have in place and where the gaps are.
FAQs
Does the FTC Safeguards Rule apply to small businesses?
Being a small business does not exempt a company from the rule. There is a narrower exception for businesses that maintain information on fewer than 5000 consumers, but it only removes a few specific requirements rather than the entire rule.
What counts as a financial institution under the rule?
The FTC defines it based on activity, not industry labels. Businesses that arrange financing and handle customers nonpublic personal information, collect debts, prepare taxes, appraise real estate, or provide similar services can all qualify, even if they do not think of themselves as financial companies.
Is my business exempt if a bank already handles our financing?
Not necessarily. If your business independently collects or maintains customers financial and nonpublic personal information, such as a car dealership arranging its own financing paperwork, you may still be covered even when a bank is also involved in the transaction.
How do I know if my business is covered?
The clearest way to find out is to look honestly at what customer financial information your business collects, stores, or has access to, and compare that against the FTC’s published examples of covered financial institu
About the Author: scott
Phishing emails used to give themselves away through bad spelling. AI has closed that gap, so your team needs a better way to tell what is real.
Most compromised business websites were never singled out. An automated tool found an outdated plugin and took it from there. Here's how to tell if your site carries that same risk, and what a fix actually looks like.
A cloud outage does not need a hacker behind it to shut down your business for a few hours. A short continuity plan is what keeps your team working and your customers informed until service returns.
Zero Trust is no longer just for large enterprises. For small businesses, it offers a practical way to limit access, reduce risk, and protect critical data as cloud tools, remote work, and modern threats change how security needs to work.
Learn how SPF, DKIM, and DMARC work together to stop email spoofing and protect your business from domain impersonation.
QR code scams are becoming more common because they can bypass traditional email security. Learn how quishing works, how to recognize it, and how to protect your business.
A cyberattack can move quickly, and the first hour matters. This guide explains what to do first, what mistakes to avoid, who to call, and how to protect your business from further damage.
AI note-takers can save time, but they also create stored records of business conversations. Before using them in sensitive meetings, know where the data goes, who can access it, and when consent is required.
Fix messy offboarding by cleaning up SaaS accounts, shared logins, personal devices, and client handoffs before they create risk.
Older Microsoft 365 tenants can carry settings that no longer match today’s security defaults. These five checks help you find quiet gaps before they create bigger risk.
STAY IN THE LOOP
Subscribe to our free newsletter.
