The FTC Safeguards Rule requires every tax preparer, CPA firm, enrolled agent, and bookkeeping practice that handles client financial data to maintain a written information security program covering nine specific safeguards, from a designated Qualified Individual to a tested incident response plan. The rule, codified at 16 CFR Part 314 and enforced under the Gramm-Leach-Bliley Act (GLBA), a federal law governing how financial institutions protect consumer financial data, took full effect on June 9, 2023. That closed a gap in which many small tax practices operated with no formal security program at all.
If your firm prepares federal or state returns, handles payroll, or offers financial planning services, the FTC treats you as a covered "financial institution" under GLBA Section 6809(3), and the FTC Safeguards Rule's requirements for tax preparers apply whether you run a solo practice or a 50-person firm. Non-compliance carries civil penalties of up to $50,120 per violation, the 2025 inflation-adjusted maximum, on top of separate exposure under IRS Publication 4557's Written Information Security Plan (WISP) mandate, the documented security program the IRS requires preparers to keep on file.
Quick Answer
The FTC Safeguards Rule (16 CFR Part 314) applies to tax preparers, CPAs, enrolled agents, and bookkeepers because the FTC classifies tax preparation as a financial activity under the Gramm-Leach-Bliley Act. Covered firms must maintain a written information security program with nine required elements, including a Qualified Individual, a written risk assessment, multi-factor authentication, encryption, and an incident response plan. Violations can draw FTC civil penalties of up to $50,120 each, and firms holding more than 5,000 customer records face additional annual penetration testing and biannual vulnerability assessments. A WISP that covers all nine FTC elements also satisfies the separate WISP requirement under IRS Publication 4557.
Key Takeaway
Nearly every paid tax preparer, including PTIN holders, CPAs, enrolled agents, and bookkeepers, counts as a covered financial institution under the FTC Safeguards Rule. The rule requires nine specific safeguards, not a general security policy. FTC penalties can reach $50,120 per violation, and firms with more than 5,000 records face extra testing requirements. One properly built WISP can satisfy both the FTC Safeguards Rule and IRS Publication 4557 at the same time.
GLBA's definition of "financial institution" at 15 U.S.C. 6809(3) is broad, and the FTC has confirmed it covers tax return preparation. The determining factor isn't your firm's size, it's whether you collect, store, or process customer financial information such as Social Security numbers, income data, and bank account details. Since nearly every tax return contains this information, the rule applies to almost all paid preparers.
- Individual tax preparers holding a Preparer Tax Identification Number (PTIN), the IRS-issued number required to prepare returns for compensation
- CPA firms and accounting practices of any size, including sole proprietorships
- Enrolled Agents (EAs) representing taxpayers before the IRS
- Bookkeeping services that handle payroll or financial recordkeeping
- Financial planning firms that also prepare tax returns
- Tax software facilitators that collect consumer financial data during return preparation
Firms operating exclusively through unpaid volunteer programs like VITA or TCE may fall outside the rule's definition, but given the FTC's broad reading of covered activity, confirm your status with a compliance advisor rather than assume an exemption applies.
The current FTC Safeguards Rule moved from a general, principles-based standard to one with specific, measurable requirements. Every covered tax practice has to address all nine elements, though how you implement each one should scale to your firm's size and risk. Use the FTC Safeguards Rule checklist as a working document while you build out each item below.
9 Elements of an FTC-Compliant Information Security Program
- Designate a Qualified Individual to oversee the information security program
- Complete a written risk assessment covering all systems, processes, and physical locations
- Implement risk-based technical, physical, and administrative safeguards
- Vet and contractually bind service providers to maintain appropriate safeguards
- Limit data access to authorized users and require multi-factor authentication
- Encrypt customer information in transit and at rest using current standards
- Continuously monitor systems and test the effectiveness of safeguards
- Train employees who access customer data, updating content for current threats
- Maintain a written incident response plan covering containment through post-incident review
Your Qualified Individual, the person formally responsible for running your information security program, doesn't need a specific certification, only the knowledge and authority to do the job. Firms with fewer than 5,000 records can have the owner serve as QI after completing security training; firms above that threshold must also deliver a written annual report to their board or senior leadership. See our guide on the Qualified Individual requirement for how to document the role.
The rule also requires multi-factor authentication (MFA) for anyone accessing customer information systems, not just remote users, unless your Qualified Individual has approved a documented compensating control. For firms running cloud-based tax software, this effectively mandates MFA across the entire workflow. Our guide to IRS Tax Pro Account MFA setup walks through configuration step by step.
Above 5,000 Records? Two More Requirements Apply
Tax practices holding information on more than 5,000 individuals must also complete annual penetration testing by a qualified independent third party and biannual vulnerability assessments. Count every record in your systems, including prior-year files kept for audit defense, not just active clients. A practice that's been open five years often crosses this threshold without realizing it. See our FTC Safeguards recordkeeping guide to check where you stand.
How to Build an FTC Safeguards Rule-Compliant Program
Appoint your Qualified Individual
Document the appointment in writing and define their authority and reporting structure. Firms above 5,000 records should consider a virtual CISO for this role.
Inventory all customer data
Map every place customer financial information lives: tax software, cloud storage, email, paper files, and portable devices. This also tells you if you've crossed the 5,000-record threshold.
Complete a written risk assessment
Document threats to customer data, rate likelihood and impact, and evaluate current safeguards. Update it after incidents, technology changes, or staffing shifts.
Implement required technical controls
Deploy MFA everywhere customer data is accessed, encrypt stored files and transmissions, and apply least-privilege access controls.
Draft your Written Information Security Plan
Document your program, risk assessment findings, safeguards, staff roles, vendor oversight, and incident response plan in one record that satisfies both the FTC rule and IRS Publication 4557.
Vet and contract your service providers
Review every vendor touching client data and require written contracts covering safeguards and breach notification timelines.
Train staff and test the program annually
Run annual security awareness training, test safeguards at least quarterly, and complete independent penetration testing if you exceed 5,000 records.
The FTC can impose civil penalties of up to $50,120 per violation, the 2025 inflation-adjusted figure under 15 U.S.C. Section 45, and each missing safeguard can count as a separate violation. Firms under an FTC consent order face an additional daily penalty of up to $43,792 until the violation is fixed and verified.
Separately, the IRS can suspend or revoke a preparer's Electronic Filing Identification Number (EFIN), the credential required to e-file returns, after a data breach or a documented failure to protect client data under IRS Publication 4557. Losing it stops you from e-filing during tax season. See our guide on the consequences of non-compliance for the full range of exposure.
Circular 230 Adds a Professional Risk on Top of FTC Penalties
Under Circular 230 Section 10.21, the Treasury Department's rules governing practice before the IRS, practitioners have duties related to client data. A security failure that leads to unauthorized disclosure can trigger a referral to the IRS Office of Professional Responsibility, independent of any FTC enforcement action, with outcomes ranging from a reprimand to suspension from practice before the IRS.
GLBA doesn't create a private right of action, but clients whose data is exposed have pursued state law claims for negligence or breach of fiduciary duty tied to GLBA-covered incidents. Defending even a favorable lawsuit often costs more than building a compliant program from the start.
FTC enforcement actions are also public record. A consent decree naming your firm follows you in search results and professional directories long after any fine is paid, which matters more than the penalty itself for a practice built on referrals. Our tax professional data breach response guide covers what to do if an incident happens despite your safeguards.
FTC Safeguards Rule vs. IRS Publication 4557
Applies to
- IRS Publication 4557
- Firms significantly engaged in financial services, which the FTC treats as including tax preparation
Enforced by
- IRS Publication 4557
- Federal Trade Commission, through civil monetary penalties
Specificity
- IRS Publication 4557
- Nine prescriptive elements, including MFA, encryption standards, and penetration testing thresholds
Core document
- IRS Publication 4557
- Written information security program
| Feature | IRS Publication 4557 |
|---|---|
| Applies to | Firms significantly engaged in financial services, which the FTC treats as including tax preparation |
| Enforced by | Federal Trade Commission, through civil monetary penalties |
| Specificity | Nine prescriptive elements, including MFA, encryption standards, and penetration testing thresholds |
| Core document | Written information security program |
One WISP Can Satisfy Both Requirements
A WISP built to cover all nine FTC Safeguards Rule elements also meets the IRS Publication 4557 mandate. Bellator Cyber Guard builds a custom WISP for tax practices starting at $749 for up to 5 users, with a custom quote for larger practices.
The FTC Safeguards Rule holds you responsible for the security practices of every vendor that touches client data, including tax software platforms, document storage services, IT contractors, and email providers. According to the Verizon 2025 Data Breach Investigations Report, third-party involvement was a factor in a significant share of confirmed breaches across industries, which makes vendor due diligence a real control rather than paperwork.
Vendor Oversight Checklist
- Request SOC 2 Type II reports or equivalent security certifications from key vendors
- Require written contracts mandating appropriate safeguards
- Confirm vendor contracts include a defined breach notification timeline
- Reassess vendor security posture periodically, not just at onboarding
- Replace or remediate any vendor that can't demonstrate adequate controls
Book a Free Tax Cybersecurity Assessment
Get a prioritized review of your practice's security program against all nine FTC Safeguards Rule elements.
Frequently Asked Questions
Yes. Any PTIN holder preparing returns for compensation is a covered financial institution under GLBA and must meet all nine elements of the rule, including designating a Qualified Individual and maintaining a written program, regardless of firm size.
Both require protecting client financial data, but the FTC Safeguards Rule (16 CFR Part 314) is enforced by the FTC through civil penalties up to $50,120 per violation, while IRS Publication 4557 is enforced by the IRS through EFIN suspension and Office of Professional Responsibility referrals. A WISP covering all nine FTC elements can satisfy both.
More than 5,000 individuals' records, counted across your entire system including prior-year files kept for audit defense, triggers mandatory annual penetration testing and biannual vulnerability assessments.
Yes, for firms under the 5,000-record threshold, the owner or principal can serve as Qualified Individual after completing appropriate security training. Firms above that threshold must also deliver a written annual report to their board or senior leadership.
The FTC can impose civil penalties up to $50,120 per violation, with a separate daily penalty of up to $43,792 under a consent order. The IRS can also suspend your EFIN, and a breach can trigger Circular 230 disciplinary proceedings independent of FTC enforcement.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.
