FTC Safeguards Rule for Lenders and Mortgage Brokers

The FTC Safeguards Rule requires nonbank lenders and mortgage brokers to run a written information security program for the customer data they hold. For a lender, that program covers every bank statement a borrower sends: one named person in charge, a risk assessment, encryption, multi-factor sign-in, secure disposal, vendor oversight and notice to the FTC after certain breaches.

Which lenders and mortgage brokers fall under the FTC Safeguards Rule?

The Safeguards Rule covers financial institutions under FTC jurisdiction that no other federal regulator oversees for this purpose. The FTC judges by activity, not by label, and its list of covered businesses names mortgage lenders, mortgage brokers, finance companies and payday lenders. A broker that never funds a loan is still covered.

The FTC's guide to the Safeguards Rule makes the point that what a company does matters more than what it calls itself. A shop that takes applications, collects pay stubs and statements, and passes files to wholesale lenders is handling the same kind of data a lender handles. The 2021 amendments also brought in "finders," businesses that bring buyers and sellers of a financial product together.

Banks and credit unions answer to their own federal regulators under the same law. The rest of this guide is about the nonbank side: independent mortgage lenders and brokers, consumer finance companies, and small business lenders that fall under the FTC.

A quick test helps. If your staff receive a borrower's bank statements, tax returns or Social Security number in order to arrange or make credit, assume the rule applies and build the program. The cost of a program you did not strictly need is small. The cost of a breach with no program in place is not.

The nine parts of a Safeguards Rule security program

A Safeguards Rule program is a written plan with administrative, technical and physical safeguards. The FTC groups its requirements into nine parts: a Qualified Individual, a risk assessment, safeguards built from that assessment, testing, staff training, oversight of service providers, updates, an incident response plan and an annual written report to the board or owner.

In plain terms, each part asks something of a lending office:

1. A Qualified Individual. One person runs the program. It can be an employee, or someone at an affiliate or outside firm, but the company stays responsible either way.
2. A risk assessment. A written look at what data you hold, where it sits and what could expose it, repeated from time to time.
3. Safeguards. Access controls, a data and systems inventory, encryption, secure app development, multi-factor authentication, disposal procedures, change management and activity monitoring.
4. Testing. Continuous monitoring, or else an annual penetration test and a vulnerability scan every six months.
5. Training. Security awareness training for everyone, and deeper training for staff who run the systems.
6. Service provider oversight. Picking vendors that can protect the data, writing the duty into the contract and checking on them periodically.
7. Keeping the program current. Revising it when the business, the risks or the people change.
8. An incident response plan. A written plan for responding to and recovering from a security event.
9. A report to the board. The Qualified Individual reports in writing at least once a year on the program's status.

The rule text sets the detail. Under 16 CFR 314.4, the Safeguards Rule's requirements section, encryption must cover customer information both at rest and in transit over external networks. Multi-factor authentication applies to anyone accessing an information system. Disposal is due no later than two years after the information was last used for the borrower, unless a business or legal need requires keeping it longer.

Bank statements as customer information under the Safeguards Rule

Bank statements are customer information because a borrower hands them over to get credit. They also tend to be the densest record in the file: account numbers, balances, employer names, payees and two to twenty-four months of spending. A Safeguards Rule program that protects the application but not the statements misses the most sensitive pages.

Statements travel more than most documents. A borrower emails them to a loan officer, the officer saves them to a shared drive, a processor uploads them to the loan origination system, and an underwriter exports them to an analysis tool. Each hop is a place the risk assessment has to name.

The same is true for business files. A lender reading bank statements to support income for a new business often collects both the company's statements and the owner's personal statements. The owner's personal accounts are plainly consumer data. Treat the business statements with the same controls, because they sit in the same folder and often show the owner's name and draws.

Decline files count too. The reasons a lender sends in an adverse action notice after a cash flow decline are drawn from the statements, and the notice itself names the applicant. Those records stay in the file and fall under the same disposal clock as approved loans.

What does the 5,000 consumer Safeguards Rule exemption remove?

The Safeguards Rule exempts institutions that hold customer information on fewer than 5,000 consumers from four specific paragraphs. A small brokerage still needs the written program, the encryption, the multi-factor sign-in and the vendor oversight. It skips the written risk assessment, the penetration tests and scans, the written incident response plan and the annual board report.

16 CFR 314.6, the small-institution exception, lists those four paragraphs by number. Everything else in section 314.4 still applies.

The count is consumers whose information you maintain, not loans closed this year. A brokerage that keeps every application and every decline for years can pass 5,000 well before its funded volume suggests it would. Count the people in your retained files, including withdrawn and declined applicants, before relying on the exemption.

Even under the threshold, skipping the incident response plan is a weak choice. The notice duty to the FTC described below applies regardless of size, and writing a plan during an incident is harder than writing it now.

Safeguards Rule oversight of vendors that receive borrower files

The Safeguards Rule makes a lender answerable for how its vendors protect borrower data. That means choosing service providers able to keep the data safe, requiring safeguards in the contract and checking on them over time. A loan origination system, a document upload portal, a processing firm and a statement analysis tool all count.

For each vendor that receives statements, a lending office should be able to answer four questions from paper, not memory:

• What data does the vendor receive, and does it need all of it?
• Does the contract require the vendor to protect it and to tell you about incidents?
• Is the data encrypted in transit and at rest on the vendor's side?
• How long does the vendor keep files after you are done, and can you shorten that?

The last question is often overlooked. Your own disposal schedule means little if a vendor keeps every upload indefinitely. When you evaluate an analysis tool, ask for its retention setting in writing. TrueBankFlow encrypts statements in transit and at rest, keeps access within your team, and lets you set how long files remain after you export the report.

Vendor oversight also ties to the privacy side of the same law. If you share borrower information with nonaffiliated third parties, the disclosures in your GLBA privacy notice should match what actually happens to the data.

Safeguards Rule gaps small lending offices leave open

Small lending offices usually fail the Safeguards Rule in ordinary places rather than exotic ones. Statements sit in personal email inboxes for years. Former loan officers keep access to the shared drive. Multi-factor sign-in covers the loan system but not email. Nobody has written down who the Qualified Individual is.

Watch for these patterns:

• Email as the filing system. A statement attached to an email stays in the sender's sent folder, the recipient's inbox and any backup. Disposal at two years is nearly impossible to prove.
• Shared logins. One processing account used by three people defeats both access control and activity logging.
• Unencrypted laptops. A downloaded file on a lost laptop is a likely notification event.
• No offboarding step. Access that is never removed is access an attacker can later use.
• Retention by default. Keeping everything forever feels safe, but the rule asks you to dispose of customer information you no longer need.

One more gap matters after an incident. The FTC requires notice when unencrypted customer information of at least 500 consumers is acquired without authorization. The notice is due as soon as possible and no later than 30 days after discovery. A shop that has never estimated how many people sit in its files cannot tell quickly whether it crossed that line.

A first-year Safeguards Rule checklist for a lending office

A first-year Safeguards Rule checklist turns the nine parts into tasks with an owner and a piece of evidence. The evidence matters most: if an examiner or a lender partner asks, you show a document, a setting or a log rather than a promise.

The table below is an example for a broker shop of about ten people. Adjust owners to your structure.

Steps 10 to 12, plus the written risk assessment, are the ones the 5,000 consumer exception removes. A shop under the threshold can still do them, and a shop near it should.

Step 6 is where most of the daily risk drops. Moving statement intake off email reduces the number of copies, gives you a single place to apply the disposal schedule, and makes access easier to log. The guide to secure document upload for lenders covers what to require of that tool, and data breach notification for lenders covers what to do if a file leaks anyway.