The FTC Safeguards Rule for bookkeepers applies when a practice counts as a financial institution, which the rule states plainly for accountants and tax preparers and leaves less clear for bookkeeping alone. Covered practices need a written security program with nine elements, including multi-factor sign-in, encryption, staff training and an incident plan.
Does the FTC Safeguards Rule cover a bookkeeping practice?
The FTC Safeguards Rule covers businesses that are "significantly engaged" in activities the law treats as financial in nature. The rule's definitions name an accountant or tax preparation service that completes income tax returns as an example. A practice that prepares returns is in. One that only keeps books is less certain and should take legal advice.
The definition sits in 16 CFR 314.2, the Safeguards Rule definitions. It ties "financial institution" to activities described in section 4(k) of the Bank Holding Company Act, then lists examples. Alongside mortgage brokers, check cashers and appraisers, it names "an accountant or other tax preparation service that is in the business of completing income tax returns."
The examples do not mention bookkeeping by name. That leaves three common situations:
- You prepare tax returns for clients, even a handful in spring. You fit the named example and should plan as a covered business.
- You keep books and run payroll, but never prepare returns. Whether that is a financial activity under the rule is a legal question. Ask a lawyer who works with small professional firms, and record the answer.
- You work as a subcontractor for a CPA firm that is covered. The firm's own program requires it to oversee service providers, so you will likely be asked to meet its controls through your contract either way.
The rule protects "customer information", which it defines as any record containing nonpublic personal information about a customer, on paper or in electronic form. Bank statements of sole proprietors, payroll registers and tax ID numbers are the obvious examples in a bookkeeping file. The post on personal information found on bank statements lists what else a statement can reveal about the people behind a business.
The nine Safeguards Rule elements in plain terms
The Safeguards Rule requires a written information security program built from nine elements: a named person in charge, a risk assessment, safeguards that address the risks, testing, staff training, oversight of service providers, keeping the program current, a written incident response plan, and a yearly report to the business's leadership. Each one can be small in a small practice.
The FTC's guide, FTC Safeguards Rule: What Your Business Needs to Know, sets out the elements in order. The table maps each to a practical action for a small bookkeeping practice.
| Element | What the rule asks | Small-practice action (example) |
|---|---|---|
| 1. Qualified Individual | One person runs the program | The owner, named in the written plan |
| 2. Risk assessment | Identify risks to customer information | A one-page list of where client data lives and what could go wrong |
| 3. Safeguards | Controls that address those risks | MFA, encryption, access limits, disposal |
| 4. Monitor and test | Check the controls work | Quarterly access review, scheduled scans |
| 5. Train staff | Security training for everyone | Phishing and payment-change training at hire and yearly |
| 6. Service providers | Choose and oversee vendors | Security terms in vendor contracts, periodic review |
| 7. Keep it current | Update as the business changes | Review when tools, staff or services change |
| 8. Incident response plan | Written plan for security events | A first-day plan with contacts and roles |
| 9. Report to leadership | Qualified Individual reports | A yearly written note to the owner or partners |
The Qualified Individual does not need a particular degree or title, according to the FTC guide, and can work for a service provider. In a one-person practice, the owner reports to themselves, which sounds odd but still produces a useful yearly record of what changed.
Safeguards the rule names specifically
Element 3 is where most of the work sits. The FTC guide names several controls, among them: limit access to customer information to those who need it, know where the data is stored, encrypt customer information on your systems and in transit, use multi-factor authentication for anyone accessing customer information, securely dispose of customer information no later than two years after it was last used to serve the customer unless there is a reason to keep it, and log what authorized users do.
Shared logins conflict with several of those at once, since you cannot limit or log a login that three people use. The guide to shared logins in a bookkeeping firm shows how to replace them.
The Safeguards Rule exemption under five thousand consumers
A practice that holds customer information on fewer than five thousand consumers is exempt from four parts of the Safeguards Rule: the written risk assessment, the continuous monitoring or penetration testing requirement, the written incident response plan, and the yearly report to leadership. Every other element still applies, including multi-factor sign-in, encryption, training and vendor oversight.
The exception is in 16 CFR 314.6, the Safeguards Rule exceptions. It lists sections 314.4(b)(1), (d)(2), (h) and (i). In plain terms:
- (b)(1): the risk assessment does not have to be written down to the rule's standard.
- (d)(2): annual penetration testing and six-monthly vulnerability scans are not required.
- (h): the written incident response plan is not required.
- (i): the written yearly report to the board or a senior officer is not required.
Most small bookkeeping practices fall under the threshold. Count carefully, though. The count is of consumers, not clients, so a payroll client with forty employees can put forty people's details in your files. A practice with two hundred clients and payroll for several of them can be further along than it looks.
Being exempt from a written plan does not mean doing without one. Insurers, larger firms you subcontract for, and clients who ask about security will still want to see a risk list and an incident plan. Writing them takes an afternoon.
Safeguards Rule controls applied to client bank statements
Client bank statements are customer information under the Safeguards Rule when they belong to individuals, and they move through more places than any other file a bookkeeper handles. Applying the rule to them means knowing every place a statement lands, limiting who opens it, encrypting it everywhere, and deleting it on a schedule.
Follow one statement from arrival to deletion and check each stop against the rule:
- Arrival. The client emails a PDF. It now sits in an inbox, which needs MFA and should not be the long-term home.
- Storage. You move it to the client's folder. The folder should be encrypted, limited to staff on that client, and shared only through named links.
- Conversion. You upload it to a conversion tool. That vendor is a service provider under element 6, so its security belongs in your vendor review.
- Export. The converted file goes into the accounting software, which needs its own MFA and access list.
- Disposal. The original is deleted on your retention schedule, from every place above.
Statement tools can make the vendor and disposal steps easier to show. AutoBankConvert encrypts files in transit and at rest and lets you choose how long originals are kept after export, so the retention setting is a line you can cite in your written program.
Copies multiply quietly. A statement uploaded twice, once by the client and once by you, is two copies to track and delete. The post on how duplicate bank statement uploads get caught explains how repeats are spotted, which helps keep the inventory honest.
Breach notice to the FTC under the Safeguards Rule
A covered business must notify the FTC within 30 days of discovering a security event in which unencrypted information about at least 500 consumers was acquired without authorization. The FTC guide states that this requirement took effect in May 2024. That notice goes to the FTC; whether clients must also be told is a separate question.
The threshold depends on encryption. The FTC guide treats encrypted information as unencrypted for this purpose only if the encryption key was also accessed. That is a strong practical reason to keep statements in encrypted storage rather than in a laptop's Downloads folder.
When an incident happens, the first questions to answer are the ones the notice needs: how many people, what kind of information, whether it was encrypted, and when you found out. Write those down on day one, even if the count is a rough estimate. The response steps themselves are covered in the incident section of the bookkeeping data security checklist.
Is Safeguards Rule work worth it if coverage is unclear?
Safeguards Rule work is worth doing even when you are not sure the rule covers your practice, because almost every element is something an insurer, a CPA partner or a careful client will ask about anyway. The controls cost little in a small practice. Being unable to show them costs more, in lost work or a denied claim.
Consider what each element buys outside the rule:
- MFA and encryption are common questions on cyber insurance applications.
- Vendor oversight is what a covered CPA firm will expect from you as its subcontractor.
- A written incident plan shortens the first day of a real incident.
- Disposal on a schedule shrinks what any breach can expose.
There is a point at which full formality outruns the risk. A one-person practice with a dozen business clients and no tax work does not need penetration testing. Scale the effort to the data you hold, and write down why you made the choices you did. A documented, reasoned choice reads far better later than no record at all.
A Safeguards Rule plan for a one or two person practice
A Safeguards Rule plan for a one or two person practice fits on two or three pages: who is responsible, where client data lives, the controls on each place, the vendors involved, how staff are trained, and what happens on the day of an incident. Review it once a year and whenever a tool or staff member changes.
A worked example
The outline below is an example for a fictional two-person practice that prepares a few tax returns each spring and serves under five thousand consumers.
Qualified Individual. The owner, Example Owner, runs the program.
Where customer information lives. Practice email, a business cloud drive, the accounting software, a statement conversion tool, and two practice laptops. Paper statements are scanned on arrival and shredded once the client confirms the scan.
Controls.
- MFA on email, cloud drive, accounting software and the conversion tool, for both people.
- Full disk encryption and automatic screen lock on both laptops.
- Each person has their own login everywhere; no shared credentials.
- Client folders limited to the person working on that client.
- Originals deleted from the conversion tool after export; cloud copies deleted two years after the client's last engagement unless the client asks for longer.
Vendors. Each vendor's security page and any report it publishes is saved in a vendor folder and reviewed at renewal.
Training. Both people review phishing and payment-change scams each January. New hires do so in their first week.
Incidents. A one-page plan lists who to call, how to lock accounts, how to count affected people, and the 30-day FTC notice for events affecting 500 or more consumers.
Review. Every January, and whenever a tool or person changes.
That outline meets the elements that apply under the exemption and goes a little further with a written incident page. It is short enough to keep up to date, which is what makes it useful. To turn it into a full document with owners and sample entries, follow the one-day written information security plan template.