Financial Compliance Built on the Safeguards Rule
Tax and accounting firms, lenders, and many advisers are 'financial institutions' under GLBA, with specific written-program duties. Fintech vendors face banks' third-party risk reviews. We run the program that answers both.
Who this is for
Accounting and tax practices, insurance agencies, mortgage brokers and lenders, and advisers not registered with the SEC; plus fintech and software vendors whose bank or credit-union customers require SOC 2 and third-party risk evidence.
Compliance for financial firms usually starts with the Gramm-Leach-Bliley Act. Firms under FTC jurisdiction — including tax preparers, mortgage brokers, and many lenders and advisers — must run a written information security program under the Safeguards Rule (16 CFR Part 314). Fintech vendors selling to banks add SOC 2 and the banks' third-party risk reviews. Both come down to documented controls and evidence that they work.
What sends financial firms looking for compliance help
Your cyber insurer, a lender, or a client asked for your written information security plan (WISP), and the firm has never written one.
A bank or credit-union prospect sent a third-party risk questionnaire asking for a SOC 2 Type II report, penetration test results, and an incident response plan.
A staff mailbox was compromised, client tax documents may have been exposed, and you need to know whether the FTC's 500-consumer notice applies.
Your errors-and-omissions or cyber policy renewal now requires MFA everywhere and proof of tested backups.
You hold a New York DFS license and must file your annual Part 500 compliance certification.
What GLBA and bank vendor reviews actually require
The FTC amended the Safeguards Rule in 2021, and most of the new requirements have applied since June 2023. The rule is more specific than its reputation. A covered firm must name a Qualified Individual to run its program, base the program on a written risk assessment, encrypt customer information in transit and at rest, require multi-factor authentication for anyone accessing customer information, keep an inventory of its systems, train staff, oversee service providers, keep a written incident response plan, and have the Qualified Individual report in writing to the board or senior leadership at least annually. Firms must also either monitor continuously or run annual penetration tests and vulnerability assessments every six months.
Since May 2024, an event involving unencrypted information of 500 or more consumers must be reported to the FTC within 30 days of discovery. Firms holding information on fewer than 5,000 consumers are exempt from some elements — the written risk assessment, continuous monitoring or testing, the written incident response plan, and the annual report — but not from encryption, MFA, or the program itself. For tax professionals the IRS points to the same rule and publishes a WISP template in Publication 5708. Insurance agencies answer to their state insurance department instead, and many states have adopted the NAIC Insurance Data Security Model Law, which follows a similar structure.
Fintech vendors sit on the other side of the same rules. Banks and credit unions are examined on how they manage third parties under the 2023 interagency guidance on third-party relationships, so they pass those expectations to vendors as questionnaires, contract clauses, and requests for a SOC 2 Type II report. A vendor that already runs a Safeguards-style program — risk assessment, MFA, encryption, logging, incident response — has most of what a SOC 2 auditor tests. The remaining work is formalizing it against the AICPA Trust Services Criteria and keeping evidence through an observation period.
Where financial firms keep customer information
Tax and accounting platforms
Professional tax software, client portals, document management, and cloud accounting files. We set MFA and access roles, configure retention, and eliminate shared logins.
Agency and policy management systems
Insurance agency management systems, carrier portals, and comparative raters. Access is reviewed per user, and carrier credentials are moved out of shared spreadsheets into a managed vault.
Loan origination and CRM
Loan origination systems, pricing engines, and CRMs holding credit reports and income documents — each a store of nonpublic personal information under GLBA.
Portfolio and custodian tools
Portfolio management, financial-planning software, and custodian portals used by advisers. Custodian access is tied to named users with MFA, not a shared office login.
Email, file sharing, and e-signature
Microsoft 365 or Google Workspace, file-sharing services, and e-signature tools carry most client documents. Encryption, external-sharing limits, and audit logging are configured here.
Fintech production systems
For vendors: the production cloud, CI/CD, support tooling, and the APIs banks connect to. These define the SOC 2 system boundary and the scope of bank questionnaires.
The compliance program we run
Qualified Individual support
The Safeguards Rule allows the Qualified Individual to be a service provider if your firm keeps responsibility and oversight. We can fill that role or support the person you designate, and produce the annual written report.
Written risk assessment and WISP
A risk assessment with defined criteria and a written information security program covering each element of 16 CFR 314.4. For tax practices it lines up with IRS Publication 5708.
MFA, encryption, and access control
MFA on every system with customer information, encryption at rest and in transit, and documented compensating controls approved by the Qualified Individual where encryption is not feasible.
Testing and monitoring
Vulnerability scans at least every six months and an annual penetration test, or continuous monitoring, with findings tracked to closure.
Service-provider oversight
An inventory of vendors that hold customer information, the security terms in their contracts, and periodic reviews — the same file a bank asks a fintech vendor to produce.
SOC 2 for fintech vendors
Scoping, Trust Services Criteria mapping, evidence automation, and auditor coordination. You engage and pay the CPA firm directly, which keeps the report independent.
First 30 days
- Confirm which rules apply: FTC Safeguards, state insurance law, NYDFS Part 500, SEC Regulation S-P, PCI DSS, or customer contracts.
- Inventory of systems and service providers that hold customer information.
- Written risk assessment drafted.
- MFA and encryption gaps closed on the highest-risk systems.
- Incident response plan drafted, including the FTC 500-consumer notice decision.
After month one
- WISP finalized and kept current as systems change.
- Semiannual vulnerability scans and an annual penetration test, or continuous monitoring.
- Annual staff training and quarterly access reviews.
- The Qualified Individual's annual written report to the board or owners.
- For vendors: SOC 2 evidence through the observation period and bank questionnaire responses.
Financial-sector rules and who they cover
GLBA Safeguards Rule — 16 CFR Part 314
Applies to non-bank financial institutions under FTC jurisdiction, including tax preparation firms, mortgage brokers, lenders, collection agencies, and investment advisers not registered with the SEC.
FTC: Safeguards Rule — What Your Business Needs to KnowFTC notification of security events — 16 CFR 314.4(j)
Events involving unauthorized acquisition of unencrypted information of at least 500 consumers must be reported to the FTC no later than 30 days after discovery, in addition to any state breach-law notices.
eCFR: 16 CFR Part 314 (Standards for Safeguarding Customer Information)SEC Regulation S-P (2024 amendments)
SEC-registered advisers and broker-dealers must maintain an incident response program and notify affected individuals within 30 days. Larger firms had to comply by December 3, 2025; smaller firms by June 3, 2026.
NYDFS 23 NYCRR Part 500
Applies to DFS-licensed firms, including New York insurance agencies and lenders, with limited exemptions for small licensees. Since November 1, 2025 it requires MFA for any individual accessing any information system, and it requires 72-hour notice of qualifying cybersecurity events.
NYDFS: Cybersecurity Regulation (23 NYCRR Part 500)State insurance data security laws (NAIC Model #668)
States that adopted the model require insurance licensees to maintain an information security program based on a risk assessment and to notify the insurance commissioner of cybersecurity events, within 72 hours under the model text.
NAIC: Insurance Data Security Model Law (#668)SOC 2 (AICPA Trust Services Criteria)
Not a regulation, but the report bank and credit-union third-party risk teams most often request from technology vendors. Security is required; Availability and Confidentiality are common additions for fintech.
AICPA: 2017 Trust Services Criteria (revised points of focus, 2022)How engagements are priced for financial firms
Fintech vendors facing a bank review can start with the SOC 2 Readiness Sprint ($5,000 fixed, 30 days). Firms without a WISP usually start with a scoped gap assessment against the Safeguards Rule. Running the program afterwards typically fits the Essential retainer ($3,500–$7,500 per month); vendors carrying SOC 2 plus cloud operations usually fit Professional ($8,000–$15,000 per month). Audit and penetration-test fees are paid to those firms directly.
Financial compliance questions
Is an accounting or tax firm really a 'financial institution'?
For GLBA purposes, yes, if it prepares tax returns or provides other financial services to consumers. The FTC lists tax preparation firms among the businesses its Safeguards Rule covers, and the IRS reminds tax professionals that they must have a written information security plan.
We have fewer than 5,000 clients. Are we exempt?
Partly. Firms holding information on fewer than 5,000 consumers are exempt from the written risk assessment, the written incident response plan, the annual report to the board, and the continuous-monitoring or testing requirement. Everything else — the Qualified Individual, encryption, MFA, training, and vendor oversight — still applies.
Does a bank need a SOC 2 or a SOC 1 report from us?
SOC 2 covers your security and operational controls and is the usual request. SOC 1 covers controls relevant to the bank's financial reporting, which matters if you process transactions or balances that land in its books. Some vendors need both; we confirm with the customer's vendor-risk team before scoping.
Can PlatOps act as our Qualified Individual?
The rule allows a service provider in that role if your firm retains responsibility for compliance, designates a senior person to oversee the provider, and requires the provider to maintain the program. On the first call we will tell you whether that or supporting an internal person fits better.
Does the FTC 30-day notice replace state breach laws?
No. It applies on top of state breach-notification laws, which have their own triggers and deadlines, and on top of customer contract terms. Your incident response plan should list every notice that could apply to your firm.
Does the SEC's four-business-day cyber disclosure rule apply to us?
It applies to public companies filing Form 8-K, not to private firms. If you are a vendor to a public company, expect it to ask how quickly you will report an incident so it can meet its own clock.
Find out which rules apply to your firm
On a call we will map your firm's obligations under the Safeguards Rule, state law, and customer contracts, and suggest the smallest program that meets them.
Related pages
Primary sources
- FTC: Safeguards Rule — What Your Business Needs to Know
- eCFR: 16 CFR Part 314 (Standards for Safeguarding Customer Information)
- IRS: Tax pros need a Written Information Security Plan
- NYDFS: Cybersecurity Regulation (23 NYCRR Part 500)
- Federal Reserve SR 23-4: Interagency Guidance on Third-Party Relationships
- AICPA: 2017 Trust Services Criteria (revised points of focus, 2022)
- SEC: Cybersecurity Disclosure Final Rules fact sheet (Form 8-K Item 1.05)