GLBA Safeguards Rule: Security Program Requirements for Fintech and Vendors

The GLBA Safeguards Rule is the US Federal Trade Commission's security rule for financial institutions outside the banking system, and it reaches much further than most technology companies expect. Under the Gramm-Leach-Bliley Act, "financial institution" covers any business significantly engaged in financial activities: fintech lenders, payment and money transfer services, mortgage brokers, car dealers that arrange financing, tax preparers, collection agencies and others. These businesses must run a written information security program with specific safeguards, and since May 2024 they must notify the FTC of certain security events.

For software and IT companies, the rule matters in two ways: fintech clients pass its requirements into vendor contracts, and some fintech products make their operators financial institutions themselves. This guide explains who is covered, the nine elements of the program, the specific technical safeguards such as MFA and encryption, service provider oversight, the FTC notification requirement, the related privacy rules, and practical steps.

What is the GLBA and the Safeguards Rule?

The Gramm-Leach-Bliley Act of 1999 reformed US financial services regulation and, in Title V, addressed the privacy and security of consumers' nonpublic personal information held by financial institutions. Two sets of rules matter most:

• Safeguards: the FTC's Standards for Safeguarding Customer Information (16 CFR Part 314), for financial institutions under FTC jurisdiction. Banks, credit unions and other depository institutions follow the Interagency Guidelines Establishing Information Security Standards issued by their regulators, which have similar objectives.
• Privacy: Regulation P (12 CFR Part 1016, administered by the CFPB) and related rules require privacy notices and give consumers the right to opt out of certain sharing with non-affiliated third parties.

Customer information means any record containing nonpublic personal information about a customer of the financial institution, in any form, handled by or for the institution.

History and why the rule was strengthened

The FTC first issued the Safeguards Rule in 2002, with flexible, principles-based requirements. Data breaches at non-bank financial companies and growth in fintech led the FTC to amend it substantially in October 2021, adding specific requirements such as a qualified individual, MFA, encryption, penetration testing and board reporting; most of these took effect on 9 June 2023. In October 2023, the FTC added a requirement to notify it of security breaches affecting at least 500 consumers, effective 13 May 2024.

Who must comply?

The FTC Safeguards Rule applies to financial institutions within FTC jurisdiction, which the rule illustrates with examples including:

• Mortgage lenders and brokers, payday lenders and finance companies.
• Account servicers, check cashers, wire transferors and money services businesses.
• Collection agencies and credit counsellors.
• Non-federally insured credit unions, and investment advisers not registered with the SEC.
• Tax preparation firms.
• Motor vehicle dealers and retailers that issue credit.
• Higher education institutions participating in federal student aid programs, which the Department of Education also oversees.
• Fintech companies offering lending, payment, personal finance and similar services, depending on their activities.

Financial institutions that maintain customer information concerning fewer than 5,000 consumers are exempt from some requirements (the written risk assessment, written incident response plan, annual board report, and continuous monitoring or penetration testing and vulnerability assessments), but must meet the rest.

Technology vendors are service providers rather than financial institutions in most cases, but they must meet contractual security requirements and are overseen by their clients.

The required information security program

The rule requires a written information security program with nine elements (16 CFR 314.4):

1. Designate a qualified individual to oversee, implement and enforce the program. This can be an employee, an affiliate or a service provider, but the institution remains responsible.
2. Base the program on a written risk assessment identifying internal and external risks to customer information, with criteria for evaluating risks and controls, repeated periodically.
3. Design and implement safeguards to control identified risks (detailed below).
4. Regularly monitor and test the effectiveness of safeguards, through continuous monitoring or, without it, annual penetration testing and vulnerability assessments at least every six months and after material changes.
5. Train staff with security awareness training and ensure security personnel keep current.
6. Oversee service providers: select capable providers, require safeguards by contract, and periodically assess them.
7. Evaluate and adjust the program in light of testing, changes and circumstances.
8. Establish a written incident response plan covering goals, processes, roles, communications, remediation, documentation and post-incident review.
9. Report to the board (or senior officer) at least annually in writing on the program's status and material matters.

Specific safeguards required (314.4(c))

• Access controls: implement and periodically review access controls, including technical and physical controls, to authorise users and limit access to customer information to what is needed.
• Data and systems inventory: identify and manage the data, personnel, devices, systems and facilities according to their importance and risk.
• Encryption of all customer information in transit over external networks and at rest, or effective alternative compensating controls approved by the qualified individual.
• Secure development practices for in-house applications, and procedures for evaluating, assessing or testing the security of externally developed applications.
• Multi-factor authentication for any individual accessing any information system, unless the qualified individual approves equivalent controls in writing.
• Secure disposal of customer information no later than two years after last use in providing a product or service, unless needed for business or legal reasons, and periodic review of retention.
• Change management procedures.
• Monitoring and logging of the activity of authorised users and detection of unauthorised access or use.

Notifying the FTC of security events

A "notification event" is the acquisition of unencrypted customer information without the authorisation of the individual it relates to. Information is treated as unencrypted if the encryption key was also accessed. When a notification event involves the information of at least 500 consumers, the institution must notify the FTC as soon as possible and no later than 30 days after discovery, through the FTC's online form, including the type of information involved, the number of consumers affected and a description of the event. The FTC may make the notifications public. State breach laws may separately require notice to consumers and state authorities.

Service provider oversight in practice

Because financial institutions remain responsible for customer information handled by their vendors, service provider oversight is where most technology companies meet the Safeguards Rule. The rule requires three things: taking reasonable steps to select and retain providers capable of maintaining appropriate safeguards, requiring those safeguards by contract, and periodically assessing providers based on the risk they present and the continued adequacy of their safeguards.

In practice, a fintech client will usually ask a software or hosting vendor for:

• A completed security questionnaire and, where available, a SOC 2 Type II report or ISO/IEC 27001 certificate.
• Contract clauses on confidentiality, permitted use of customer information, encryption, MFA, access limits, subprocessor approval, incident notification timelines and data return or deletion at the end of the contract.
• Evidence of secure development practices, such as code review, dependency scanning and penetration test summaries.
• Prompt notice of security incidents so the institution can meet its own 30-day FTC deadline and state breach laws.

Vendors that prepare this evidence in advance shorten sales cycles with financial clients. Keeping production access limited, logged and protected by MFA, and using masked or synthetic data in development and testing, removes many of the questions before they are asked.

The privacy side of GLBA

Under Regulation P, financial institutions must give customers a clear privacy notice describing their information sharing practices, generally at the start of the relationship and annually unless an exception applies, and allow consumers to opt out of sharing nonpublic personal information with non-affiliated third parties, subject to exceptions such as sharing with service providers under contract. Vendors processing data on an institution's behalf usually fall within those exceptions but must be bound by confidentiality obligations.

How to comply, step by step

1. Confirm whether you are a financial institution under the rule, or a service provider to one.
2. Appoint a qualified individual and document their authority.
3. Inventory customer information, systems and data flows, including vendors.
4. Write the risk assessment with defined criteria.
5. Implement the named safeguards: MFA everywhere, encryption, access reviews, logging and monitoring, change management, secure development, retention and disposal.
6. Test: continuous monitoring, or annual penetration tests and semi-annual vulnerability assessments.
7. Write the incident response plan, including the FTC 30-day notification process.
8. Oversee vendors: contracts with security requirements and periodic assessments, using SOC 2 reports where available.
9. Train staff and report to the board annually.
10. Provide privacy notices and opt-outs as Regulation P requires.

Documentation you will need

• Written information security program.
• Qualified individual designation.
• Written risk assessment and updates.
• Asset and data inventory.
• Access control, encryption, secure development, change management and retention policies.
• Monitoring, penetration test and vulnerability assessment reports.
• Training records.
• Service provider contracts and assessments.
• Written incident response plan and incident records, including FTC notifications.
• Annual board reports.
• Privacy notices.

Enforcement and certification

The FTC enforces the Safeguards Rule as an unfair or deceptive practice matter, typically through consent orders requiring security programs, independent assessments for many years and reporting. Violations of orders can lead to civil penalties. There is no certification; institutions often use NIST CSF, ISO/IEC 27001 or SOC 2 to structure and evidence their programs.

Timeline and cost considerations

The amended rule has been in effect since June 2023 and the FTC notification requirement since May 2024. Costs include staff or outsourced qualified individual services, MFA and encryption across systems, logging and monitoring, penetration testing, vendor management and training. Smaller institutions under 5,000 consumers have reduced documentation and testing duties but must still implement core safeguards.

Benefits and consequences

A strong program reduces breach risk, satisfies banking partners and investors, and is required to work with many payment and lending partners. FTC enforcement has led to long-running consent orders with ongoing assessment obligations, and breaches trigger state notification duties, litigation and reputational harm.

Common mistakes and challenges for IT companies

• Not realising the business is a financial institution under the broad definition.
• MFA only for some systems; the rule applies to any individual accessing any information system unless an approved alternative exists.
• Unencrypted data in internal databases, backups or logs.
• No disposal schedule, keeping customer data indefinitely.
• Vendor contracts without security requirements.
• No process for the FTC 30-day notification.

Best practices, tools and technologies

• Use SSO with MFA for staff and strong MFA options for customers.
• Encrypt databases, backups and file storage with managed keys; encrypt sensitive fields.
• Centralise logs and alert on unusual access to customer data.
• Integrate security testing into development and run independent penetration tests.
• Automate retention and deletion.
• Keep a vendor inventory with risk ratings and SOC 2 reports.

We build fintech platforms and integrations with encryption, MFA, audit logging and secure development, through our web application and API integration services.

How the GLBA relates to other frameworks

Law or framework	Relationship
PCI DSS	Card data standard many financial institutions must also meet.
CCPA/CPRA	Data subject to GLBA is largely exempt from the CCPA, but the business may be covered for other data.
SOX	Applies to listed companies' financial reporting controls; different purpose.
NIST CSF and ISO/IEC 27001	Frameworks for structuring the information security program.
SOC 2	Evidence financial institutions use to oversee service providers.

Real-world enforcement examples

The FTC has brought Safeguards Rule cases against tax preparation services, auto dealers, mortgage companies and fintech firms for failures such as lacking a written program, not encrypting data, not monitoring service providers and weak access controls. These cases show that the FTC examines both technical safeguards and accountability, and its orders commonly require biennial independent assessments for up to 20 years.

An illustrative case for a US fintech lender with an Indian development partner: the lender's qualified individual requires the partner to use MFA for all access to production and source code, work only on masked data in development, follow secure coding and code review practices, report incidents within 24 hours, and provide its SOC 2 report annually. The lender documents the partner in its vendor risk assessment and its annual board report.

Next steps

1. Determine whether you are a financial institution or a service provider to one.
2. Appoint a qualified individual and write the risk assessment.
3. Implement MFA, encryption, logging and disposal.
4. Set up testing, vendor oversight and the FTC notification process.
5. Report to the board and review annually.

Frequently asked questions

Who must comply with the GLBA Safeguards Rule?

Non-bank financial institutions under FTC jurisdiction, including many lenders, brokers, tax preparers, auto dealers that finance, collection agencies and fintechs. Banks follow similar interagency guidelines.

Does the Safeguards Rule apply to software vendors?

Not usually as financial institutions, but vendors that handle customer information for financial institutions must meet contractual safeguards and are overseen by their clients.

Does the Safeguards Rule require MFA?

Yes, for any individual accessing any information system, unless the qualified individual approves equivalent reasonably secure controls in writing.

What is a qualified individual?

The person responsible for overseeing, implementing and enforcing the information security program, who can be an employee, affiliate or service provider.

When must the FTC be notified of a breach?

As soon as possible and no later than 30 days after discovering a notification event involving unencrypted information of at least 500 consumers.

Are small businesses exempt?

Institutions with customer information on fewer than 5,000 consumers are exempt from some documentation and testing requirements but not from core safeguards.

How often must penetration tests be done?

Annually, with vulnerability assessments at least every six months, unless the institution has effective continuous monitoring.

What happens to data no longer needed?

It must be disposed of securely no later than two years after last use in providing a product or service, unless needed for business operations or legal reasons.

Is there a GLBA certification?

No. Institutions document their programs and may use frameworks and assessments such as NIST CSF, ISO/IEC 27001 or SOC 2 as evidence.

Does GLBA cover privacy too?

Yes. Regulation P requires privacy notices and opt-outs for certain sharing of nonpublic personal information.