Why the GLBA Safeguards Rule Applies to Your Non-Bank Business, and Where Your Liability Actually Lands

The FTC Letter That Surprised a Twelve-Person Tax Firm — And What It Means for Your Business

The FTC sent an inquiry letter to a small accounting practice in 2024. The firm employed twelve people, had no relationship with any bank, considered itself a tax-preparation business, and assumed, reasonably enough at the time, that financial-services regulation was something other people had to worry about. The letter explained that the FTC believed the firm was a covered financial institution under the Gramm-Leach-Bliley Act's Safeguards Rule, that the firm was therefore obligated to maintain a written information security program with nine specific elements, and that the FTC was inquiring whether such a program existed.

It did not.

The story The CEO of a non-bank business reads about GLBA enforcement, assumes it applies to commercial banks and credit unions, and turns the page. The 2021 FTC revision quietly broadened the rule's reach in ways most non-bank CEOs have never been briefed on, and the enforcement that has followed is not theoretical. It is operational, ongoing, and aimed at the exact category of business the rule's authors did not previously see as financial institutions.

Three categories of businesses, in particular, have been surprised to learn they are now squarely inside the Safeguards Rule's scope.

Which Businesses Are Actually Covered by the Safeguards Rule in 2026

The term means more than it used to. The Gramm-Leach-Bliley Act in 1999 defined a financial institution as any business engaged in financial activities. The FTC's revised Safeguards Rule, which took final effect in mid-2023, expanded the working definition by clarifying through enforcement, through guidance, and through specific industry examples that "financial activities" includes activities most people associate with non-bank professional services.

The list of covered businesses is not exhaustive, but it is concrete. Mortgage brokers and lenders are covered. Auto dealers extending financing or leasing to consumers are covered. Tax preparation firms handling consumer financial information are covered. Real estate firms that finance, broker, or arrange consumer credit are covered. Debt collectors are covered. Credit reporting agencies are covered. Investment advisors below the SEC threshold are covered. Payday lenders, consumer loan finders, and check cashers are covered. Law firms that perform escrow, hold client funds, or arrange consumer financing are increasingly being treated as covered, depending on the activity profile.

The CEO test is not whether your business sees itself as a financial institution. The CEO test is whether your business engages in any of the activities the FTC has named, directly or as a substantial line of service to your consumer clients. If it does, the rule applies.

The Nine Elements the Safeguards Rule Requires — No Exceptions

The Safeguards Rule does not give a covered firm flexibility on what its security program must contain. It specifies. A covered firm must designate a qualified individual responsible for the information security program. The firm must perform a written risk assessment that identifies reasonably foreseeable internal and external risks to consumer information. The firm must implement and document specific safeguards, including access controls, encryption of consumer information in transit and at rest, multi-factor authentication on systems containing consumer information, secure disposal practices, change management procedures, and monitoring of authorized user activity.

The firm must oversee its service providers, since vendor risk management is no longer optional. The firm must train its workforce. The firm must regularly evaluate the program. And the firm must produce annual written reports to its governing body, which means the board of directors, the managing partner, or the CEO and the executive team where no formal board exists.

That last element is the one most non-bank CEOs are not prepared for, and it is the one the FTC has flagged most consistently. The rule expects the CEO or the equivalent governing body to be receiving, reviewing, and acting on a written annual report describing the security program, the risks identified, the controls implemented, and the incidents detected. If your firm does not produce such a report, your firm is not in compliance, regardless of how good its IT controls are.

Why "We're Too Small for the FTC to Bother With" Has Become an Expensive Assumption

Most non-bank CEOs eventually hear some version of this argument from inside their own organization: we are too small for the FTC to bother with, the rule was meant for the big institutions, and the cost of a full Safeguards program is disproportionate to our risk.

That is a false choice, and the FTC's enforcement record over the last several years has made it an expensive one to keep believing in. The FTC has explicitly reframed its enforcement program around the Safeguards Rule to target small and mid-sized covered firms, exactly the firms whose CEOs assumed the rule was not aimed at them. Civil penalties for Safeguards Rule violations can reach significant amounts per violation. Consent decrees commonly require twenty years of FTC monitoring, biennial third-party audits, and quarterly board reporting at the firm's expense. The firms that have signed those decrees did not believe the rule applied to them either, until the day it did.

The right framing is not whether your firm can afford to operate a full Safeguards program. It is whether your firm can afford the cost of operating one under FTC monitoring rather than on your own terms. The first option is a budgeted operating expense. The second option is a multi-year corrective-action plan, and the cost differential is rarely close.

The Sequence a Non-Bank CEO Should Walk Through Right Now

A non-bank CEO who has just learned the rule applies has a defined sequence to walk through.

Designate a qualified individual in writing, as a named role with documented responsibility for the security program. Commission a written risk assessment that covers consumer financial information specifically, scoped to the systems and processes your firm uses to handle it. Inventory the systems where consumer financial information lives, including those run by service providers. Implement multi-factor authentication, encryption, and access controls on those systems, with documentation of what is enforced and what is not. Update your service-provider contracts to require equivalent safeguards downstream. Train your team. Establish an annual written report to your governing body. Document the program. And, most often missed, schedule the next year's evaluation now, on the calendar, with a named owner.

Five Nines goes through this exact sequence with our partners outside traditional banking. The firms that finish it find that the Safeguards Rule program becomes part of the operating discipline, not a parallel track that competes with the work. The firms that do not finish it find that the Safeguards Rule program eventually becomes part of an FTC consent decree, and the operating discipline is no longer theirs to define.

Finish the Program on Your Own Terms Before the FTC Sets Them

The FTC sent its letter to a twelve-person tax firm because the rule applied to that firm, and the rule's authors do not see size as a reason it should not. The firms that finish their Safeguards programs on their own terms will find the cost defensible. The firms that wait will eventually finish them under monitoring, on someone else's terms, and the cost will not be defensible at all.

If your firm has not formally evaluated whether the Safeguards Rule applies, and if applicable, designated a qualified individual and commissioned a written risk assessment, that is the conversation worth having now, before an inquiry letter forces it.

Five Nines Technology Group is a Tech-Operations partner for professional services, banking, and consumer-financial firms. Translating regulatory and operational frameworks into operating discipline is where our team focuses.