Does the FTC Safeguards Rule Apply to Your Business? The Activity Test Explained

Many business leaders begin with the wrong question. They ask "Are we a bank?" and, satisfied with the answer, stop.

The better question is whether the organization is significantly engaged in activities that are financial in nature, or incidental to financial activities, and whether it handles customer information in connection with those activities.

A business does not have to call itself a bank, a lender, or a financial institution for the FTC Safeguards Rule to become relevant. The Rule reaches certain financial institutions under the FTC's jurisdiction, and that term turns on the activities a business performs, not the label it uses. The analysis is fact-specific, and a legal determination belongs to qualified counsel. What follows is meant to help leadership understand which questions are worth investigating first.

Why the activity test matters

The Safeguards Rule requires covered financial institutions to develop, implement, and maintain an information security program designed to protect customer information. FTC guidance describes that program as including administrative, technical, and physical safeguards, overseen by a designated Qualified Individual.

For an owner or executive, the first issue is not whether the company has cybersecurity software, an MSP, or a written policy. It is whether the organization's actual activities create the need for a more formal analysis in the first place.

That matters because an organization may:

• Collect consumer financial information through applications, intake forms, uploaded documents, email, portals, or paper records
• Arrange financing or facilitate applications for a financial product or service
• Maintain systems storing borrower, buyer, taxpayer, or client financial information
• Rely on outside providers that access, process, store, or transmit customer information
• Have functioning cybersecurity controls but no accountable owner, written program, evidence inventory, or leadership reporting

Read that list again and notice what the last item is doing. The first four are about technology and information. The fifth is not. What most organizations discover is a governance problem wearing a technology problem's clothes.

What "financial institution" actually means

Under 16 CFR §314.2(h), a financial institution is an institution whose business is engaging in an activity that is financial in nature, or incidental to such financial activities. The definition draws on the activities described in section 4(k) of the Bank Holding Company Act.

This is why a business should not rely on its category label. A company may not describe itself as a financial institution and still perform activities that warrant a closer look: arranging financing, receiving financial applications, supporting consumer lending processes, facilitating financial transactions, or handling consumer financial information in connection with covered activities.

FTC guidance offers examples including mortgage brokers, payday lenders, finance companies, account servicers, and businesses engaged in financing-related activities. The examples are illustrations of activities, not a roster of industries. That distinction is the entire point, and it is the one most commonly lost in secondhand summaries.

See the worked coverage examples from the regulation itself →

The five-question practical test

Before anyone buys anything, leadership should be able to answer these five in plain language.

Three common business situations

These are educational illustrations, not legal conclusions. Whether the Rule applies depends on the actual services, activities, information, and jurisdictional facts of a specific organization.

Auto dealers

A dealership may collect credit applications, driver's license information, proof of income, insurance details, bank information, and financing documentation. It may transmit that information to lenders, work through a dealer management system, and maintain records with third-party technology platforms.

The relevant question is not limited to whether the dealership originates loans. Leadership should examine whether the dealership arranges financing, facilitates credit applications, handles customer financial information, and maintains a program reflecting those risks.

Mortgage brokers and originators

Brokers, originators, and processors work routinely with borrower financial information: income documents, credit records, bank statements, tax returns, lender portals, and third-party technology providers.

Because the work is closely connected to consumer financial activity, the useful starting point is usually not whether sensitive information exists. It plainly does. The question is whether leadership can demonstrate accountable governance around it.

Tax preparation and accounting firms

Tax preparers and accounting firms receive highly sensitive information: income documents, tax records, account numbers, payroll data, identity information, business financials, and documents uploaded to preparation software or client portals.

Coverage still requires fact-specific analysis. Regardless of where that lands, these firms should be able to map where sensitive information enters, who can reach it, which vendors process it, what safeguards exist, and what evidence shows those safeguards are managed.

What covered organizations are expected to have

If the Rule applies, the organization must develop, implement, and maintain a written information security program with administrative, technical, and physical safeguards appropriate to its size and complexity, the nature and scope of its activities, and the sensitivity of the customer information it handles.

Section 314.4 sets out nine program elements at (a) through (i). You will frequently see this described as ten. That framing folds in §314.4(j), which is not a program element at all but an event-triggered duty to notify the FTC. The distinction is not pedantry: the §314.6 exceptions lift four of the nine for organizations under 5,000 consumers and never touch (j), so counting it as a tenth element hides the fact that it reaches you at any size.

This does not mean every business needs the same technology or the same volume of paperwork. It means a covered organization needs a program scaled to its operations, and evidence that the program exists and is being maintained.

All nine elements, and what record proves each one →

A WISP alone is not proof

A written program matters. But a document by itself does not demonstrate that anything is operating.

Leadership should be able to identify who owns the program, when the risk assessment was last updated, which safeguards address the organization's significant risks, how training is assigned and documented, which vendors can reach customer information and how they are overseen, what testing and incident-response evidence exists, and what the Qualified Individual has reported to senior leadership.

At PaperTrailProof we use Governance Proof Status to describe whether an organization can locate clear, current, accountable evidence for the components of its program.

A practical next step

Do not start by buying a generic WISP template, and do not assume an IT provider has settled the governance question. Start with a structured review of five areas: coverage (what financial activities the business performs), accountability (who owns the program), program (what policies, assessments, and procedures exist), evidence (what records show the program operates), and decision (whether to run it internally, use oversight support, or engage managed governance).

The Governance Proof Status is built to organize that first conversation. It does not provide legal advice or a coverage determination. It helps an organization see which activities, information flows, ownership questions, and evidence areas need review next. It also tells you what you may be exempt from, which is frequently more than people expect.

Frequently asked