Blog
The FTC Safeguards Rule: Does It Apply to Your Firm?
September 12, 2026
"Does this actually apply to me?" is the most common question we hear about the FTC Safeguards Rule, usually from firm owners who assume it's aimed at banks and lenders, not a five-person bookkeeping practice. The short answer is that if your firm touches client tax returns, payroll data, or financial statements, it almost certainly applies to you too — and the exemptions are narrower than most people expect.
Who counts as a "financial institution"
The Safeguards Rule is part of the Gramm-Leach-Bliley Act (GLBA), and GLBA defines "financial institution" far more broadly than the name suggests. It's not limited to banks — it covers any business "significantly engaged" in providing financial products or services. The FTC's own guidance explicitly names tax preparation services, accounting firms, and other professionals who handle client financial data as covered entities. If your firm prepares returns, manages books, processes payroll, or advises on client finances, you're inside the definition, not adjacent to it.
The small-firm exemption is narrower than it sounds
There is a carve-out for firms maintaining customer information on fewer than 5,000 consumers — but it only removes three specific obligations: a written risk assessment, a written incident response plan, and annual reporting to a board or governing body. It does not exempt a small firm from the rule's core requirements. You still need to designate a qualified individual to oversee your security program, implement access controls and encryption, require multi-factor authentication on systems storing client data, and vet the vendors and software that touch that data. A two-person firm and a fifty-person firm are held to the same baseline on those points.
What being in scope actually requires
- Designating a qualified individual responsible for your information security program
- Encrypting client data both in transit and at rest
- Requiring multi-factor authentication on any system that stores customer information
- Assessing and monitoring the risk posed by every service provider or software vendor with data access
- Having a plan to detect, respond to, and recover from a security incident
None of this is optional guidance — it's the operative text of the rule, and the FTC has already brought enforcement actions against firms that treated it as aspirational.
Why a generic checklist doesn't actually get you compliant
This is where a lot of firms go wrong: they download a generic Safeguards Rule template, fill in the blanks, and consider the question closed. The rule requires your security program to match your firm's actual risk profile — the specific software you use, how many staff have data access, whether you use outside contractors, and how client documents move through your systems. A template built for a generic firm doesn't account for the QuickBooks integration, client portal, or automation tools your firm specifically runs, which is exactly where a lot of real exposure sits. Applicability is the easy question; building a program that reflects how your firm actually operates is the part that takes real work — and it's not something a one-size-fits-all software product can do for you.
What this means for your software and vendors
Confirming the rule applies to your firm doesn't stop at your own staff and systems — it extends to every vendor that touches client data. Any software, cloud storage provider, or outside developer building tools for your firm needs to be vetted and covered under a written agreement describing how they protect that data. If you're evaluating a new automation tool or client portal, ask directly how it handles encryption, access control, and data retention before you adopt it.
Once you've confirmed the rule applies, the next step is building the actual plan — see our guide to WISP requirements for tax preparers for what that document needs to cover. This is also part of our complete guide to AI for accountants.
Frequently Asked Questions
Does the FTC Safeguards Rule apply to accounting and bookkeeping firms?
In almost all cases, yes. The rule applies to any business that qualifies as a "financial institution" under the Gramm-Leach-Bliley Act, and the FTC's own guidance names tax preparation, accounting, and bookkeeping services as covered activities. Handling client tax returns, payroll, or financial statements is generally enough to put a firm in scope.
Is there an exemption for small firms?
A limited one. Firms that maintain customer information on fewer than 5,000 consumers are exempt from a few specific elements — a written risk assessment, a written incident response plan, and annual reporting to a board. The core requirements — a qualified individual, access controls, encryption, MFA, and vendor oversight — still apply regardless of firm size.
What's the difference between the Safeguards Rule and a WISP?
The Safeguards Rule is the regulation; a Written Information Security Plan (WISP) is the document a firm produces to comply with it. Confirming the rule applies to your firm is the first step — building the WISP itself is a separate, more detailed task. See our guide on WISP requirements for the full breakdown.
What happens if a firm doesn't comply?
The FTC can pursue civil penalties of up to $100,000 per violation, and the IRS has tied Safeguards Rule compliance to PTIN renewal for tax preparers — meaning non-compliance can also threaten a preparer's ability to legally file returns.
Does hiring a software vendor transfer the compliance burden away from my firm?
No. Using a vendor or software platform doesn't remove your firm's obligations — it adds a new one. GLBA requires firms to vet any third party with access to client data and have a written agreement covering how that vendor safeguards it. Your firm stays on the hook regardless of who processes the data.
We build every tool around your firm's specific risk profile and workflow — never a generic template.
Book a Free Consultation