What is FTC Safeguards Rule?
The FTC Safeguards Rule is a federal regulation requiring 'financial institutions' (broadly defined to include tax preparers, mortgage brokers, wealth managers, auto dealers, and many others) to maintain a written Information Security Program.
The original Safeguards Rule dates to 1999, but the December 2022 amendment massively expanded both the scope and the specific controls required. As of June 2023 every covered business must have a written Information Security Program, an MFA-backed access control system, encryption for customer information at rest and in transit, a Qualified Individual responsible for the program, regular Risk Assessments, and an annual report to the board.
The 'financial institution' definition is famously broad: tax preparers, mortgage brokers, motor-vehicle dealers, payday lenders, investment advisors, real-estate appraisers, debt collectors, and check-cashing services are all in scope. Many small businesses don't realize they're covered until an enforcement action hits.
Penalties for non-compliance can include consent orders, injunctions, and civil penalties - enforcement actions in 2024-2026 have resulted in 6- and 7-figure judgments against small operators.
Why it matters for Florida small business
If you're a Florida CPA, mortgage broker, wealth manager, or auto dealer, this is mandatory - not optional. The IRS now requires Section 6713 disclosure of compliance status on Schedule G.
What to do
Stand up a written Information Security Program, name a Qualified Individual, and run an initial Risk Assessment. The WISP Template gets you 80% of the way there.