The FTC Safeguards Rule for tax preparers, 16 CFR Part 314, applies because tax preparation firms count as financial institutions under the Gramm-Leach-Bliley Act. It requires a written information security program with a named Qualified Individual, a risk assessment, safeguards such as multi-factor authentication and encryption, and notice to the FTC after larger breaches.
Which tax preparers the FTC Safeguards Rule covers
The FTC Safeguards Rule covers tax preparation firms as a named category of financial institution, with no minimum size. The rule implements the Gramm-Leach-Bliley Act, which reaches businesses engaged in activities that are "financial in nature." The rule's scope section lists tax preparation firms by name among the businesses under the FTC's jurisdiction.
The text is in 16 CFR 314.1 (eCFR, current as of October 14, 2026). It says an entity is a financial institution "if its business is engaging in an activity that is financial in nature or incidental to such financial activities" under the Bank Holding Company Act. It then names examples, including "credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions."
The FTC's own guide says the same. FTC Safeguards Rule: What Your Business Needs to Know (FTC, December 2024) notes that section 314.2(h) "lists 13 examples of the kinds of entities that are financial institutions under the Rule," and tax preparation firms are one of them.
The IRS agrees and adds the size point. IRS Publication 5708 (Rev. 8-2024) says "tax and accounting professionals are considered financial institutions, regardless of size." IRS Publication 4557 (Rev. 6-2024) says the financial institution definition "includes professional tax preparers."
The rule protects "customer information," and it reaches more than a firm's own clients. Section 314.1(b) says the rule "applies to all customer information in your possession," including information about customers of other financial institutions that shared it with you.
Two definitions control the numbers later in the rule. A "consumer," under 16 CFR 314.2 (eCFR), is an individual who obtains a financial product or service "primarily for personal, family, or household purposes." The small-firm exemption and the breach notice threshold both count consumers, which means individuals rather than business entities.
What does the Gramm-Leach-Bliley Act require of accountants beyond the Safeguards Rule?
Beyond the Safeguards Rule, the Gramm-Leach-Bliley Act imposes privacy duties: telling customers how their information is shared and, in some cases, letting them opt out. Those privacy duties are set out in Regulation P, 12 CFR Part 1016. The Safeguards Rule is about protecting information; Regulation P is about disclosing it.
12 CFR 1016.1 (eCFR) says Regulation P "Requires a financial institution to provide notice to customers about its privacy policies and practices," describes when nonpublic personal information may be shared with nonaffiliated third parties, and gives consumers a way to opt out of most of that sharing.
Tax clients are named in the regulation. Among the examples of a customer relationship in 12 CFR 1016.3 (eCFR) is an individual who "Becomes your client for the purpose of obtaining tax preparation or credit counseling services from you."
The notice duties, as the regulation states them:
- Initial notice. Section 1016.4 requires "a clear and conspicuous notice that accurately reflects your privacy policies and practices" to a new customer "not later than when you establish a customer relationship."
- Annual notice. Section 1016.5 requires a notice "not less than annually" during the relationship. 12 CFR 1016.5(e) (eCFR) excuses the annual notice when the institution shares information only under the regulation's listed exceptions and has not changed its disclosure practices since the last notice.
- Contents. Section 1016.6 lists what a notice includes, such as the categories of information collected and disclosed and the consumer's right to opt out.
- Opt out. Section 1016.10 bars disclosure to nonaffiliated third parties, outside the exceptions, unless the consumer received notice, had a reasonable chance to opt out, and did not.
The difference is practical. Security duties ask "is the data protected?" Privacy duties ask "has the client been told who sees it?" A firm can meet one and miss the other, and the FTC has charged both in the same case.
Safeguards Rule exemptions for small tax firms
The Safeguards Rule exempts small tax firms from four provisions when they hold customer information on fewer than 5,000 consumers. Those four are the written risk assessment, the penetration testing and vulnerability assessment schedule, the written incident response plan, and the Qualified Individual's annual written report. Every other requirement applies regardless of size.
16 CFR 314.6 (eCFR) reads: "Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers." The FTC's guide repeats the threshold and points to the same section.
The exemption removes the written form of the risk assessment, not the assessment. Section 314.4(b) still requires the program to be based on a risk assessment for every firm. Only (b)(1), which says the assessment "shall be written" and lists its contents, drops away.
Provisions table for a firm under 5,000 consumers
The table lists each part of 16 CFR 314.4 (eCFR) and whether it applies to a firm holding customer information on fewer than 5,000 consumers.
| Provision | What it requires | Under 5,000 consumers | 5,000 or more |
|---|---|---|---|
| 314.4(a) | Designate a Qualified Individual | Applies | Applies |
| 314.4(b) | Base the program on a risk assessment | Applies | Applies |
| 314.4(b)(1) | Written risk assessment with set criteria | Exempt | Applies |
| 314.4(b)(2) | Periodic additional risk assessments | Applies | Applies |
| 314.4(c) | Safeguards: access controls, inventory, encryption, secure development, MFA, disposal, change management, logging | Applies | Applies |
| 314.4(d)(1) | Regularly test or monitor key controls | Applies | Applies |
| 314.4(d)(2) | Continuous monitoring, or annual penetration testing and six-monthly vulnerability assessments | Exempt | Applies |
| 314.4(e) | Security awareness training and qualified personnel | Applies | Applies |
| 314.4(f) | Oversee service providers, including by contract | Applies | Applies |
| 314.4(g) | Evaluate and adjust the program | Applies | Applies |
| 314.4(h) | Written incident response plan | Exempt | Applies |
| 314.4(i) | Annual written report by the Qualified Individual | Exempt | Applies |
| 314.4(j) | Notify the FTC of a notification event involving 500 or more consumers | Applies | Applies |
Multi-factor authentication and encryption sit inside 314.4(c), so they apply to every firm. The rule allows one route around each: MFA can be replaced by "reasonably equivalent or more secure access controls" that the Qualified Individual has "approved in writing," and encryption can be replaced by "effective alternative compensating controls" the Qualified Individual reviews and approves. How a firm picks and rolls out MFA is covered in multi-factor authentication for tax professionals.
The IRS sample plan does not use the exemption. Publication 5708's template includes a breach procedures attachment and an annual review for every firm. Firms decide for themselves how much of that to keep. The WISP elements the rule requires, mapped to owners and evidence, are in the required elements of a tax preparer WISP.
The Safeguards Rule breach notice to the FTC
The Safeguards Rule breach notice requires a financial institution to tell the FTC about a "notification event" involving the information of at least 500 consumers, as soon as possible and no later than 30 days after discovery. The notice is filed on an online form on the FTC's website. The requirement took effect on May 13, 2024.
The rule defines the trigger in 16 CFR 314.2 (eCFR). A notification event is "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains." Encrypted information counts as unencrypted "if the encryption key was accessed by an unauthorized person." Unauthorized access is presumed to be acquisition unless the firm has "reliable evidence" otherwise.
The clock starts at discovery, and discovery is broad. Section 314.4(j)(2) treats an event as discovered "as of the first day on which such event is known to you," and the firm is deemed to know if any employee, officer or other agent knows, other than the person committing the breach.
The notice must include, under section 314.4(j)(1):
- The firm's name and contact information.
- The types of information involved.
- The date or date range of the event, if it can be determined.
- The number of consumers affected or potentially affected.
- A general description of the event.
- Whether law enforcement has determined in writing that public notice would impede a criminal investigation or harm national security, with a way for the FTC to reach that official.
A law enforcement official may ask for an initial delay of up to 30 days, extendable by up to 60 more days on a written request. Section 314.5 sets the effective date as May 13, 2024. The FTC business blog post of May 14, 2024 confirms companies "must use a new online form." The FTC's guide adds that reports "may be made public."
The FTC notice is separate from reporting to the IRS. Publication 5708 lists the FTC alongside the IRS Stakeholder Liaison, state agencies and law enforcement. The steps for reporting a theft to the IRS are in how to report data theft to the IRS as a tax preparer.
How does the FTC enforce the Safeguards Rule against tax preparers?
The FTC enforces the Safeguards Rule through investigations and administrative orders. One action against a tax preparer settled in 2017 with an online tax preparation service whose customer accounts were taken over. The order barred future violations of the Safeguards and Privacy Rules for 20 years and required outside assessments for 10.
The FTC press release of August 29, 2017 describes the case. Attackers gained "full access to nearly 9,000" customer accounts from October to December 2015 and used the data for tax identity theft. The FTC alleged that the company did not develop a "written comprehensive security program" until November 2015, did not conduct a risk assessment, and lacked safeguards such as adequate risk-based authentication and strong password requirements.
The case also included a privacy count. The FTC alleged the company failed to provide a "clear and conspicuous initial privacy notice" and did not deliver it in a way that ensured customers received it. The same initial-notice duty appears in Regulation P at 12 CFR 1016.4, and the case shows the two sets of obligations being enforced together.
The settlement terms were long-lasting. For 20 years the company is prohibited from violating the Privacy Rule and the Safeguards Rule, and for 10 years it must obtain biennial third-party assessments of its compliance.
The IRS points to the same consequence. Publication 4557 says a preparer's failure to create and enact a security plan "may result in an FTC investigation." The rule itself makes clear which records exist to be reviewed: the written risk assessment, the incident response plan, the Qualified Individual's annual report (for firms above the threshold), and any written approval of an MFA or encryption alternative.
Phishing is how many tax office breaches start, and it is one of the risks a firm's assessment should name. Examples aimed at tax offices are collected in phishing scams targeting tax preparers.
A firm's service-provider list under section 314.4(f) includes every tool that receives client files. If Schema CPA is where a firm's client uploads arrive, it belongs on that list with the rest; the workflow section of the homepage shows what it does with each document. Firms that review vendors after the season can fold this into the work described in the tax season workflow category.