FTC Safeguards Rule

No changes recorded yet — we are watching, and nothing has been published.

1. 2024-05-13 Duty to notify the FTC of notification events (16 CFR 314.4(j)) takes effect
2. 2023-06-09 Delayed provisions of the 2021 amendments start to apply
3. 2022-01-10 2021 amendments to the Safeguards Rule take effect
4. 2003-05-23 Original Safeguards Rule takes effect

1. 2023-11-13
   16 CFR 314 as amended November 2023 AmendmentCurrent text

   Added a duty to report notification events involving unencrypted information of 500 or more consumers to the FTC; effective 13 May 2024. source

2. 2022-11-23
   Delay of the 2021 amendments Amendment

   Delayed the provisions that were to apply from 9 December 2022 until 9 June 2023. source

3. 2021-12-09
   2021 amendments Major version

   Five main changes, including detailed guidance on access controls, authentication and encryption; effective 10 January 2022. source

4. 2002-05-23
   Original Safeguards Rule Major version

   First Standards for Safeguarding Customer Information, effective 23 May 2003. source

The rule covers the customer information of financial institutions within the FTC's jurisdiction.

Financial institution

An entity is a financial institution if its business is engaging in an activity that is financial in nature or incidental to it under 12 U.S.C. 1843(k). source

Examples

Mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, collection agencies, tax preparation firms and investment advisors that aren't required to register with the SEC; the 2021 amendments added finders. source

Small institutions

Institutions with customer information on fewer than 5,000 consumers are exempt from the written risk assessment, continuous monitoring or penetration testing, written incident response plan and annual board report requirements (314.4(b)(1), (d)(2), (h) and (i)). source

The institution runs and tests its own information security program and reports on it to its board at least annually.

Qualified Individual

The institution must designate a Qualified Individual to oversee and enforce its information security program; this person may work for an affiliate or a service provider. source

Board report

The Qualified Individual reports in writing, regularly and at least annually, to the board of directors or equivalent governing body. source

Testing

Without effective continuous monitoring, the institution must run annual penetration tests and vulnerability assessments at least every six months. source

Multi-factor authentication

MFA is required for any individual accessing any information system, unless the Qualified Individual approves equivalent or more secure controls in writing. source

Breach notice to the FTC

A notification event involving at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery. source

The FTC enforces the rule against the financial institutions within its jurisdiction.

Enforcement authority

The rule applies to the financial institutions subject to the Commission's enforcement authority, namely those not subject to another regulator under GLBA section 505. source

1. Law text 16 CFR part 314 – Standards for Safeguarding Customer Information
2. Guidance FTC Safeguards Rule: What Your Business Needs to Know
3. Law text Final rule adding FTC notification of security events (13 November 2023)
4. Law text Final rule amending the Safeguards Rule (9 December 2021)

1. FCRA / FACTA Red Flags

   The Red Flags Rule requires a program to detect identity theft in covered accounts; the Safeguards Rule requires a program to protect customer information generally.

2. NYDFS Part 500

   NYDFS Part 500 covers firms licensed by New York's financial regulator; the Safeguards Rule covers non-bank financial institutions under federal FTC jurisdiction.

3. HIPAA

   The HIPAA Security Rule protects electronic health information; the Safeguards Rule protects customer information held by financial institutions.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to FTC Safeguards Rule (RSS)