The FTC Safeguards Rule for tax preparers is not a gray area: the Rule names tax preparation firms itself, and applies to far more businesses than the phrase “financial institution” suggests. If you prepare returns for compensation, you are covered, and you are required to have a written information security program containing nine specific elements.
This is what the Rule requires of a small firm, what the under-5,000-consumer relief actually removes, and where the obligations sit that firms most often miss.
Who the FTC Safeguards Rule for tax preparers covers
The Rule – formally the Standards for Safeguarding Customer Information, 16 CFR Part 314 – applies to financial institutions under the FTC’s jurisdiction, and the FTC is explicit that its definition is broader than ordinary usage. What matters is the activity the business undertakes, not how the business describes itself.
Section 314.2(h) lists thirteen examples, including tax preparation firms, mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, collection agencies, credit counselors and other financial advisors, non-federally insured credit unions, and investment advisors not required to register with the SEC. The 2021 amendments added “finders” – businesses that bring buyers and sellers together.
The FTC also makes a point worth heeding: business operations change, so the definition is worth re-reading periodically. A practice that was not covered a decade ago may be covered now.
What the FTC Safeguards Rule for tax preparers actually requires
A written information security program, with administrative, technical and physical safeguards, appropriate to the size and complexity of the business, the nature and scope of its activities, and the sensitivity of the information at issue.
“Customer information” means any record containing nonpublic personal information about a customer, in paper, electronic or any other form, handled or maintained by you or on your behalf. Note the last part – information held by a vendor on your behalf is still yours for this purpose.
The program has three stated objectives: ensure the security and confidentiality of customer information; protect against anticipated threats to it; and protect against unauthorised access that could result in substantial harm or inconvenience to a customer.
The nine elements of the FTC Safeguards Rule for tax preparers, briefly
- Designate a Qualified Individual to implement and supervise the program.
- Conduct a written risk assessment with criteria for evaluating risks, reassessed periodically.
- Design and implement safeguards – access controls, data inventory, encryption in transit and at rest, app assessment, multi-factor authentication, secure disposal within two years of last use, change management, and logging of authorized user activity.
- Monitor and test – continuous monitoring, or annual penetration testing plus six-monthly vulnerability scans.
- Train staff, with refreshers and specialized training for those running the program.
- Monitor service providers – select them for capability, write security expectations into contracts, reassess periodically.
- Keep the program current.
- Write an incident response plan covering goals, processes, roles, communications, remediation, documentation and a post-mortem.
- Report annually in writing to the board or a senior officer.
What the small-entity relief does and does not remove
The FTC has exempted financial institutions maintaining customer information concerning fewer than 5,000 consumers from certain provisions – in practice the written risk assessment, the monitoring and testing requirement, the written incident response plan, and the annual report.
It does not remove the requirement to have a written information security program, and it does not remove any of the concrete safeguards in element three. Encryption, multi-factor authentication, access control, secure disposal and activity logging apply regardless of size.
Count carefully before relying on the relief. Five thousand consumers is information you maintain, not clients you currently serve – and a practice that has retained returns for a decade may be well past it without ever having felt large.
The three FTC Safeguards Rule obligations firms most often miss
Multi-factor authentication, everywhere
The Rule requires multi-factor authentication for anyone accessing customer information on your system, using at least two of: something you know, something you have, something you are. The only exception is where the Qualified Individual has approved an equivalent control in writing. Most firms have it on one or two systems and not on all.
Secure disposal within two years
Customer information must be securely disposed of no later than two years after the most recent use in serving that customer, unless there is a legitimate business need or legal requirement to retain it, or targeted disposal is not feasible. Very few small practices have a disposal routine at all.
Service provider contracts
Element six requires selecting providers capable of maintaining appropriate safeguards, spelling out security expectations in the contract, building in a way to monitor their work, and periodically reassessing them. Most firms have never asked a vendor a written security question, let alone contracted for one.
Breach notification under the FTC Safeguards Rule since May 2024
Section 314.4(j) requires notifying the FTC as soon as possible and no later than 30 days after discovery of a notification event: a breach involving unauthorised acquisition of at least 500 consumers’ unencrypted information, reported through the FTC’s online form.
Two definitions matter. Encrypted information counts as unencrypted if the key was accessed by an unauthorised person. And unauthorised access is treated as unauthorised acquisition unless reliable evidence shows otherwise – meaning the default assumption runs against you.
Where a vendor fits under the FTC Safeguards Rule for tax preparers
Element six is the one where your provider choice becomes a compliance question rather than a preference. You are required to be able to describe your providers’ safeguards and to have contracted for them.
We can answer those questions in writing: hardware owned and operated by us in the United States, nothing scanned for advertising or passed to third parties, encryption in transit and at rest, and multi-factor authentication available on every account. Liberation Email starts at $1.95 per user per month and Hub For Teams, which adds secure file sharing instead of emailing documents as attachments, at $7.49 per user.
What no vendor can do is write your program or certify your firm. Ask us the vendor questions and file the written answers with your plan.
How the nine elements map to real work
| Element | Who does it | Roughly how long |
|---|---|---|
| Designate a Qualified Individual | Partner or owner | An hour, including writing it down |
| Written risk assessment | Qualified Individual | A day, once the data inventory exists |
| Access controls and MFA | Whoever administers each system | A day, mostly waiting for people to enrol |
| Encryption | Your providers | Verification, not implementation |
| Secure disposal | Practice manager | Half a day to define, then routine |
| Monitoring and testing | Provider or external | Scheduled, not continuous effort |
| Staff training | Qualified Individual | An hour a year, plus refreshers |
| Service provider review | Whoever signs contracts | An afternoon of emails |
| Incident response plan | Qualified Individual | Half a day against the Rule’s list |
Set out that way the project is a few days spread over a quarter, not a transformation program. The reason it feels bigger is that the data inventory has to come first and nobody enjoys it.
What FTC Safeguards Rule enforcement looks like in practice
The FTC publishes this guidance as the small entity compliance guide under the Small Business Regulatory Enforcement Fairness Act, and is explicit that your best source is the text of the Rule itself. That is worth taking literally: where a vendor’s summary and the Rule differ, the Rule governs.
The practical exposure for a small firm is less about a proactive audit and more about what happens after an incident – when the question becomes what program existed, whether it was written, and whether it was followed. A plan produced after the fact is worth very little. One dated, reviewed and demonstrably followed is worth a great deal.
Where the FTC Safeguards Rule for tax preparers overlaps with the IRS requirements
Most firms encounter this subject twice and assume they are two separate projects. They are not. The FTC Safeguards Rule for tax preparers and the IRS’s own expectations describe substantially the same work, and one document can satisfy both if you write it once with both readers in mind.
The IRS points at the FTC rule directly. Publication 4557 and the IRS’s guidance for practitioners both reference the FTC requirement rather than inventing a parallel standard. So when the IRS asks whether you maintain a written data security plan, it is asking about the same written information security program the FTC Safeguards Rule for tax preparers requires. One plan, two audiences.
The PTIN renewal question is the one that surprises people. The annual PTIN renewal asks preparers to confirm awareness of their data security responsibilities. Answering yes while holding no written plan is not a comfortable position, and it is the moment many firms discover the obligation exists. Writing the plan takes an afternoon; discovering you need it during renewal week is the avoidable part.
Breach reporting runs in two directions. Since May 2024 the FTC requires notification of a security event affecting 500 or more consumers, and the FTC publishes its explanation of the notification change in plain language. Separately, the IRS asks preparers to contact their Stakeholder Liaison promptly after a data theft, with no minimum threshold. A firm that only knows about one of these will handle a bad day badly.
Vendor oversight is the shared weak point. Both regimes expect you to select and monitor the providers who touch client data, and both expect it in writing. This is where a small firm’s exposure usually sits: the tax software, the portal, the cloud storage, the IT contractor and the email provider, none of them formally assessed. The FTC Safeguards Rule for tax preparers makes that assessment an explicit requirement rather than good practice.
Write it once, structure it for both. Name the qualified individual, list the data and where it lives, record the risks and the safeguards, note the vendor review, log the training, and write down what happens in a breach and who gets called. That document answers the FTC, answers the IRS, and – more usefully – actually tells your staff what to do.
Treated as one piece of work, compliance with the FTC Safeguards Rule for tax preparers is an annual afternoon rather than a project. Treated as two, it tends to be neither.
A closing note on proportion. The FTC Safeguards Rule for tax preparers is written to cover institutions far larger than a two-person practice, and reading it cold can suggest a compliance burden that simply does not apply at your size. The obligations that genuinely bind a small firm are a written program, an honest look at your risks, real oversight of the vendors holding client data, and a plan for the bad day. Everything else in the text is scaled to the firm it applies to. Read the FTC Safeguards Rule for tax preparers with that in mind and it becomes an afternoon’s work rather than a reason to hire a consultant.
A 90-minute plan for meeting the FTC Safeguards Rule for tax preparers
If you have read this far and have nothing written down, here is the shortest honest path from nothing to defensible. Block ninety minutes before the season starts and work through it in order. You will not produce a perfect program, and you do not need one.
Minutes 0 to 15: name the qualified individual. In most small firms this is the owner, and that is entirely acceptable – the Rule requires the role to be filled, not outsourced. Write the name and the date at the top of a blank document. The FTC Safeguards Rule for tax preparers begins here, and it is the single easiest element to satisfy.
Minutes 15 to 40: list the data and where it lives. Tax software, the portal, email, cloud storage, the scanner folder, laptops, the filing cabinet, and any device that goes home. For each, note roughly what client information it holds and who can reach it. This list is the risk assessment in embryo, and almost every firm finds at least one surprise while writing it.
Minutes 40 to 60: write down the safeguards you already have. Multi-factor authentication where it is switched on. Disk encryption where it exists. The portal you already use instead of email attachments. Backups, and whether you have ever restored one. Be accurate rather than aspirational – a plan claiming controls you do not have is worse than one admitting a gap with a date next to it.
Minutes 60 to 75: list your vendors. Every company that touches client data, what it does, and whether you have anything in writing with it. Vendor oversight is where the FTC Safeguards Rule for tax preparers most often finds small firms short, and the fix is usually a short email asking for the provider’s standard terms.
Minutes 75 to 90: write the bad day. Who is called first, in what order, with real phone numbers on the page: your IT support, your insurer, your IRS Stakeholder Liaison, your state agency. Add one line on what you would tell clients. That is your incident response plan, and having it written at all puts you ahead of most practices your size.
Sign it, date it, store a copy somewhere that is not the office laptop, and diarise a review for the same week next year. Ninety minutes, once a year, and the FTC Safeguards Rule for tax preparers stops being a thing you worry about and becomes a thing you have done.
Frequently asked questions
Does the FTC Safeguards Rule apply to tax preparers?
Yes. Section 314.2(h) lists thirteen examples of entities that are financial institutions under the Rule, and tax preparation firms are named explicitly. What matters is the activity the business undertakes, not how it describes itself.
What counts as a financial institution under the Safeguards Rule?
An entity engaged in an activity that is financial in nature or incidental to such activities. Examples include tax preparation firms, mortgage lenders and brokers, finance companies, account servicers, check cashers, wire transferors, collection agencies, credit counselors, non-federally insured credit unions, certain investment advisors, and finders.
Is a small firm exempt from the Safeguards Rule?
Not exempt, but relieved of certain provisions. Firms maintaining customer information on fewer than 5,000 consumers are exempt from the written risk assessment, monitoring and testing, the written incident response plan and the annual report. The written information security program itself still applies.
What is a Qualified Individual under the Safeguards Rule?
The single named person who implements and supervises the program. They may be an employee, an affiliate or a service provider, and no particular degree or title is required. Where a service provider fills the role, the firm must designate a senior employee to supervise them and the provider must maintain its own security program.
What are the Safeguards Rule breach notification requirements?
Since May 2024, covered firms must notify the FTC as soon as possible and no later than 30 days after discovering a breach involving the unauthorised acquisition of at least 500 consumers’ unencrypted information, through the FTC’s online reporting form.
Related reading
- IRS Publication 4557: A Plain-English Checklist for Tax Practices
- WISP for Tax Preparers: The 9 Elements You Must Write
- How to Protect Your Business Online — The wider security picture for a small firm.
- Business Email Setup — Email on your own domain, with the agreement in place.