Most people look for their industry on a list. That is the wrong question, and it produces a false no more often than a false yes. The Safeguards Rule does not define coverage by industry. It defines coverage by activity. So the question that decides it is this one:
Does your organization collect, receive, store, transmit, or use consumers' financial information in connection with providing or arranging financial products or services?
If you answered yes, or if you are not sure, the rest of this page shows you exactly which activities the Rule follows and where each one appears in the text. Every citation here has been checked against the eCFR. None of it decides your coverage for you. It shows you how the decision is made.
Three questions, in order. All three have to be yes.
The Rule borrows its definition from section 4(k) of the Bank Holding Company Act. A financial institution is any institution the business of which is engaging in an activity that is financial in nature or incidental to such financial activities. Notice that the subject of that sentence is the activity, not the industry.
16 CFR 314.2(h)(1)This is the word that does the work, and it cuts both ways. An organization that engages in a financial activity but is not significantly engaged in it is not a financial institution. An organization that does it as a usual part of its business is. The Rule gives four worked examples of what does not count, and we walk through them below.
16 CFR 314.2(h)(3)(iv) and 314.2(h)(4)The Rule reaches financial institutions over which the Federal Trade Commission has enforcement authority under the Gramm-Leach-Bliley Act. Banks and credit unions with a federal prudential regulator answer to that regulator instead. That is why a business can be a financial institution and still not be covered by this particular Rule.
16 CFR 314.2(s) and 314.1(b)Each of these appears in the Rule's own worked examples at 16 CFR 314.2(h)(2), or in the entities named at 314.1(b). Under each activity are organizations where that activity commonly shows up. Those are examples of where the activity is found, not a list of who qualifies. Two businesses on the same street can land differently depending on what they actually do.
This family catches the most organizations, and it is where the false no usually happens.
The Rule's first worked example is a retailer that extends credit by issuing its own credit card directly to consumers. Extending credit is a financial activity, and issuing it through a proprietary card is what shows the retailer is significantly engaged in extending it.
You do not have to lend your own money. The Rule treats brokering loans as a financial activity in its own right, and it treats the consumer as your consumer the moment they apply, whether or not any credit is ever extended. The Rule expressly contemplates an organization that undertakes to arrange or broker a home mortgage loan, or credit to purchase a vehicle, for a consumer.
The Rule's second worked example is an automobile dealership that, as a usual part of its business, leases automobiles on a non-operating basis where the initial term is at least 90 days. Read the example carefully: the dealership is a financial institution with respect to its leasing business. The activity is what carries the coverage, which is exactly the principle this page is built on.
If you hold ownership or servicing rights to a consumer's loan, that individual is your consumer, even if you hold those rights alongside other institutions and even if collection is handed to an agent. A consumer is also yours if they are obligated on an account you purchased from another institution, in default or not, so long as you try to collect.
Exchanging or moving money is a financial activity under the statute. Doing it regularly is what makes an organization significantly engaged in it.
A check cashing business is a financial institution because cashing a check is exchanging money, which the statute lists as a financial activity.
A business that regularly wires money to and from consumers is a financial institution, because transferring money is a financial activity and doing it regularly is what demonstrates significant engagement.
A business that prints and sells checks for consumers is a financial institution, whether that is its whole business or one product line among many.
These are professional services, which is precisely why the organizations providing them often do not think of themselves as financial institutions.
An accountant or other tax preparation service in the business of completing income tax returns is a financial institution, because tax preparation is a listed financial activity. A consumer becomes your customer when they become your client for tax preparation.
An investment advisory company and a credit counseling service are each financial institutions, because providing financial and investment advisory services are financial activities. An individual who gives you nonpublic personal information while seeking such advice is your consumer, whether or not a continuing advisory relationship is ever established.
One of the Rule's more surprising examples. A career counselor who specializes in serving people employed by, displaced from, or seeking work with a financial organization, or with the finance, accounting, or audit department of any company, is a financial institution.
Property transactions pull several distinct financial activities into one closing table.
A personal property or real estate appraiser is a financial institution, because real and personal property appraisal is a listed financial activity. Note the boundary: a consumer who obtains a one-time appraisal does not thereby have a continuing relationship with you, which changes who is a customer without changing whether you are a financial institution.
An entity that provides real estate settlement services is a financial institution, and a consumer who obtains those services from you has a continuing relationship with you.
The two examples organizations almost never expect.
A company that brings together buyers and sellers for transactions the parties themselves negotiate and consummate is a financial institution, because acting as a finder is an activity that is financial in nature or incidental to a financial activity. This category was added to the Rule in 2021 and it is broad.
A business that operates a travel agency in connection with financial services is a financial institution. The qualifier matters, and it is the reason isolated ticket sales are treated differently.
These are the objections we hear most. In each case the Rule addresses it in its own words.
The Rule treats an individual who applies to you for credit for personal, family, or household purposes as a consumer of a financial service regardless of whether the credit is extended. The same is true of someone who gives you nonpublic personal information just to find out whether they might qualify for a loan. Funding is not the trigger. The application is.
The Rule also states that a financial service includes your evaluation or brokerage of information you collect in connection with a consumer's request or application for a financial product or service. Taking the application and passing it along is itself the financial service.
16 CFR 314.2(b)(2)(i) and (ii); 314.2(g)(2)Be careful with this one, because the answer has two parts and most summaries get it wrong. It is true that selling a consumer's loan without retaining servicing rights ends the continuing customer relationship. But that is not the same question as whether the information is still covered.
The Rule applies to all customer information in your possession, regardless of whether that information pertains to individuals with whom you have a customer relationship, and it expressly reaches information belonging to customers of other financial institutions that was provided to you. So the obligation attaches to what you still hold, not to whether the relationship is still live. If the file is in your building, it is in scope.
16 CFR 314.1(b); compare 314.2(e)(2)(ii)(B)There is no size floor for coverage. Size changes what you must do, not whether the Rule reaches you. An organization that maintains customer information on fewer than five thousand consumers is relieved of four specific requirements: the written risk assessment, the continuous monitoring or annual penetration testing and semi-annual vulnerability assessment provision, the written incident response plan, and the Qualified Individual's written report.
Read that list again. Every one of those four is a documentation requirement. The rest of the Rule, including designating a Qualified Individual, still applies in full.
16 CFR 314.6, lifting 314.4(b)(1), (d)(2), (h), and (i)A page that only tells you who is covered is a sales page. Here is the other side, in the Rule's own examples of organizations that are not significantly engaged in financial activities.
The Rule's four worked examples of what does not count
Notice the word doing the work in every one of them: merely, or occasional. The line is not the industry. The line is whether the activity is a usual part of the business.
16 CFR 314.2(h)(4); the governing exclusion is at 314.2(h)(3)(iv)Colleges and universities that participate in Title IV federal student aid programs are required to comply with 16 CFR Part 314, but the obligation reaches them through a route worth understanding, because it is not the same one as everything above.
The Department of Education requires it contractually. Every institution participating in Title IV agrees in its Program Participation Agreement to comply with the Safeguards Rule, and the Department treats compliance as part of its determination of an institution's administrative capability. The FTC's own longstanding position, stated when it issued the companion Privacy Rule in 2000, is that many if not all such institutions appear to be significantly engaged in lending funds to consumers.
So the practical answer is yes, and the enforcement risk runs through both the Department and the FTC. But an institution reading this should know its obligation rests on a program participation agreement and an administrative capability standard, not only on a worked example in Part 314.
Title IV Program Participation Agreement; 34 CFR 668.16 administrative capability; ED Electronic Announcement GEN-23-09 (Feb. 9, 2023); 65 Fed. Reg. 33646, 33648 (May 24, 2000)Section 314.4 sets out nine program elements, lettered (a) through (i). Those are the components of the information security program itself. Section 314.4(j) sits alongside them but is a different kind of obligation: an event-triggered duty to notify the FTC of a notification event involving the unencrypted customer information of at least 500 consumers, as soon as possible and no later than 30 days after discovery. It has been in effect since May 13, 2024.
You will see this counted as ten elements almost everywhere, including in material from firms selling compliance products. It is an understandable shorthand and it costs you two real things. First, the §314.6 exceptions lift four of the nine written requirements for organizations maintaining information on fewer than 5,000 consumers, and they never touch (j), so folding (j) into the list obscures that it reaches you at any size. Second, discovery under (j) is treated as the date the event became known to any employee, officer, or agent other than whoever caused it. The clock can already be running before leadership hears anything, which is a very different problem from a program component you build once and maintain. See all nine, and what record proves each one →
The one most often missed entirely is (g), which requires you to evaluate and adjust your program in light of testing results, material changes to your operations or business arrangements, risk assessment results, or any other circumstance you know or have reason to know may have a material impact on it. Most organizations do adjust. Very few can show what prompted the adjustment.
You now know how coverage is decided, which activities carry it, and where the line sits on the other side. What you do not know yet is what you would actually be able to produce if someone asked.
That is the next question, and it takes about five minutes. The Governance Proof Status opens with the same coverage question you read at the top of this page, so you are told plainly if the Rule does not reach you. If it does, you walk through 21 questions mapped to 16 CFR Part 314. Each one asks what a regulator, an insurer, or an investor would ask, which is not what you have installed but what evidence you could put in front of them.
At the end you get your status out of 100, the three things you are already doing well, and the single next proof worth your attention. Nothing is sold to you on that screen.
Start your Governance Proof Status →Every citation on this page was verified against the eCFR text of 16 CFR Part 314 current as of August 2026. This page is educational and is not legal advice, an audit, or a determination of compliance. Coverage turns on your organization's specific facts. Consult qualified counsel regarding your circumstances.
PaperTrailProof™ · A.V. Señero, Governance Evidence Translator™ · Turn uncertainty into proof.