What category of obligation this is
The official name is the Standards for Safeguarding Customer Information. The short name is the Safeguards Rule. It is codified at 16 CFR Part 314. The eCFR purpose statement states that this part implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley Act. It also sets standards to protect the security, confidentiality, and integrity of customer information.
That is an FTC rule about customer information. It is not a payment-industry standard. It is not the examination handbook for every bank.
The regulator comes first
Part 314 applies to financial institutions over which the FTC has jurisdiction. Those institutions are not otherwise subject to the enforcement authority of another regulator under section 505 of the Gramm-Leach-Bliley Act. FTC guidance states that the definition of "financial institution" in the Rule is broader than everyday speech. What matters are the activities, not the label that the company uses for itself.
Examples in the FTC guidance and in § 314.1(b) include these roles: Mortgage lenders. Payday lenders. Finance companies. Mortgage brokers. Account servicers. Check cashers. Wire transferors. Collection agencies. Credit counselors. Tax preparation firms. Non-federally insured credit unions. Investment advisors that are not required to register with the SEC. Finders.
Federally supervised banks, and many credit unions, often answer first to other regulators. Those regulators include the OCC, the Federal Reserve, the FDIC, the NCUA, and others. The responsible regulator comes first. A coverage answer goes to counsel or compliance.
A written program, not a product
Covered financial institutions must develop, implement, and maintain a written information security program. § 314.3 states that the program contains administrative, technical, and physical safeguards. Those safeguards must fit the size and complexity of the institution. They must also fit the nature and scope of activities, and the sensitivity of customer information. The objectives are the security and confidentiality of customer information. They also include protection against anticipated threats or hazards to the security or integrity of that information. They also include protection against unauthorized access or use that can result in substantial harm or inconvenience to a customer.
In the definition of the Rule, customer information is any record that contains nonpublic personal information about a customer of a financial institution. The record can be in paper, electronic, or other form. The institution or its affiliates handle or maintain that record, or someone does so on behalf of them. That customer-information lane is not the same sentence as payment account data under PCI DSS.
Program elements as categories
§ 314.4 lists elements of that written program. The FTC guidance and the eCFR text hold the detail. The themes are: Qualified Individual oversight. A written risk assessment. Safeguards to control the risks that the institution identifies. Tests and checks. Personnel instruction. Service-provider oversight. Evaluation of the program. A written incident response plan. A written Qualified Individual report to the board, or to an equivalent body, at least annually. If there is no board or equivalent body, the report goes to a senior officer at least annually.
Safeguard themes inside that risk-based design include these items: Access controls. A record of which data and systems the institution has. Encryption, or an alternative that the Qualified Individual approves. Multi-factor authentication themes. Secure disposal. Change management. Logs and checks of authorized users.
A list of the themes is not a checklist that finishes the program. § 314.6 excepts some of those elements for financial institutions that maintain customer information about fewer than five thousand consumers. Counsel or compliance decides whether that exception applies.
Notification
§ 314.5 states that section 314.4(j) is effective as of 13 May 2024. Under § 314.4(j), a notification event can involve the information of at least 500 consumers. If it does, the financial institution must notify the FTC as soon as possible. The notice must also arrive no later than 30 days after discovery. The notice is electronic, on a form on ftc.gov.
That is a category about notice time. Counsel or compliance decides whether a real event is a notification event.
FFIEC guidance is related, not this rule
The FFIEC guidance is Authentication and Access to Financial Institution Services and Systems. The press release is dated 11 August 2021. It is interagency examination guidance on risk assessment and layered authentication and access for covered financial institutions. It is not 16 CFR Part 314. It is not a universal law on its own.
OCC and NCUA handbooks are also separate instruments. They are not part of the Safeguards Rule.
Rewrite the one-line claim
The sentence "every U.S. bank follows FTC Safeguards as their one cyber law" is not accurate. A regulator-first sentence states that the Safeguards Rule is an FTC customer-information program rule for financial institutions under FTC jurisdiction. Payment card data is a PCI DSS question. FFIEC authentication guidance is related examination guidance, a different instrument.
At work, the team privately asks counsel or compliance which regulator owns customer-information security for one product line.
Phrases that are often confused
| Phrase people use | Literacy correction |
|---|---|
| Finance cyber = Safeguards | Only if the entity is an FTC-jurisdiction financial institution under Part 314. Many banks and credit unions answer to other regulators first. |
| Safeguards = FFIEC | Safeguards is the FTC rule (16 CFR Part 314). The FFIEC document is examination guidance. Related theme (authentication and access), different instrument. |
| Safeguards = PCI | PCI DSS is a payment-industry standard for payment account data, run through brands and acquirers. Different category. |
| We bought a tool, so Safeguards is done | The Rule frames a written program and risk-based safeguards, not a single product. |
Common misconceptions
Every bank and credit union is primarily an FTC Safeguards story.
Part 314 frames financial institutions under FTC jurisdiction that are not under another GLBA section 505 enforcer. The regulator comes first before a name for the rule.
Safeguards, FFIEC, and PCI are the same finance cyber rule.
The Safeguards Rule is 16 CFR Part 314. FFIEC authentication guidance is interagency examination guidance. PCI DSS is a payment-industry standard for payment account data. Related themes are not the same instrument.
An encryption checkbox, or an MFA checkbox, means Safeguards is done.
Encryption and multi-factor authentication are safeguard themes inside a written, risk-based program. One control alone is not the program. A tool purchase is not the program.
A vendor badge that says GLBA compliant replaces the jurisdiction question.
A homepage badge does not decide whether the entity is a financial institution under FTC jurisdiction. That question belongs to counsel or compliance. That decision uses the activities and the regulator, not a slogan.
The Safeguards Rule covers only electronic records.
Customer information can be in paper, electronic, or other form.
Sort three finance sentences
| Sentence | Lane | What the fact is |
|---|---|---|
| FTC customer-information program rule for covered financial institutions under FTC jurisdiction. | Safeguards Rule | Standards for Safeguarding Customer Information, 16 CFR Part 314. Regulator first. Not every bank. |
| Payment card data security standard, validated through brands and acquirers. | PCI DSS | A different regime for payment account data. |
| Interagency examination guidance on authentication and access. | FFIEC, related | The 11 August 2021 press release is examination guidance. It is not Part 314. |
CHECK THE CATEGORY
Which statement describes the FTC Safeguards Rule lane accurately?
Glossary and nearby pages
Use the agency page in the sources for the authoritative text.