FTC Safeguards Rule for Tax Preparers: 2026 Compliance Guide

What the FTC Safeguards Rule Means for Tax Preparers

The Federal Trade Commission's Safeguards Rule, codified at 16 CFR Part 314, imposes legally binding data security requirements on tax preparers, Certified Public Accountants (CPAs), bookkeepers, and any firm significantly engaged in providing financial services. Enacted under the Gramm-Leach-Bliley Act (GLBA), the updated FTC Safeguards Rule took full effect on June 9, 2023, closing a long-standing gap in which many small tax practices operated without a formal information security program.

If your firm prepares federal or state tax returns, manages payroll, or provides financial planning services, you are almost certainly a "financial institution" under this rule—and the compliance requirements are specific, enforceable, and tied to significant civil penalties. The Federal Trade Commission has made clear that tax preparers fall within the rule's definition of a covered financial institution, and enforcement activity against non-compliant firms has increased since the expanded requirements took effect.

For tax professionals already familiar with IRS Publication 4557 and its Written Information Security Plan (WISP) requirement, the FTC Safeguards Rule adds another enforceable layer on top of IRS guidance. Where the IRS can revoke your Electronic Filing Identification Number (EFIN), the FTC can impose civil monetary penalties per violation. Together, these two regulatory frameworks create a strong compliance imperative that every tax preparer must address proactively.

Does the FTC Safeguards Rule Apply to Your Tax Practice?

One of the most common misconceptions among independent tax preparers and small CPA firms is that the FTC Safeguards Rule only targets large financial institutions like banks and insurance companies. The rule's definition of "financial institution" under GLBA Section 6809(3) is deliberately broad: it includes any business significantly engaged in financial activities, which the FTC has specifically confirmed encompasses tax preparation services.

The following business types are covered under the FTC Safeguards Rule for tax preparers:

• Individual tax preparers holding a Preparer Tax Identification Number (PTIN) who prepare returns for compensation
• CPA firms and accounting practices of any size, including sole proprietorships
• Enrolled Agents (EAs) representing taxpayers before the IRS
• Bookkeeping services that handle payroll or financial record preparation
• Financial planning firms that also prepare tax returns as part of their service offering
• Tax software facilitators who collect consumer financial data as part of the return preparation process

The determining factor is not your firm's size but whether you collect, store, or process "customer financial information"—a term the FTC defines to include Social Security Numbers, income data, bank account details, and any other nonpublic personal information obtained in connection with providing a financial service. Because virtually every tax return contains this type of data, the FTC Safeguards Rule's applicability to tax preparers is effectively universal among paid preparers.

If your practice operates exclusively through a volunteer program like VITA or TCE and you do not charge for services, you may not qualify as a covered financial institution under the rule. However, reviewing your specific situation with a compliance advisor before assuming any exemption applies is the prudent course of action—the FTC's enforcement posture has signaled a broad reading of who qualifies as a covered financial institution.

Breaking Down the Nine Required Elements

The updated FTC Safeguards Rule expanded from a general principles-based framework to one with specific, measurable requirements. Understanding what each element demands in practice—particularly for tax preparers running lean operations—is essential for building a compliant program without over-engineering your security posture.

Qualified Individual and Leadership Reporting

Your Qualified Individual does not need to hold a specific certification but must have the knowledge and authority to implement and manage your information security program effectively. For firms with fewer than 5,000 customer records, a business owner who has completed security training can serve as the QI. Firms above the 5,000-record threshold must also submit written reports to their board of directors (or equivalent senior leadership) at least annually, covering program status, risk assessment findings, and material changes to the security environment.

Risk Assessment Requirements

Your written risk assessment must identify reasonably foreseeable internal and external threats to your customer data, evaluate the likelihood and potential damage of each identified threat, and assess the sufficiency of your existing safeguards. For tax preparers, high-priority threats typically include phishing attacks targeting tax professionals, credential stuffing against tax software portals, and ransomware targeting client file repositories. The assessment must be updated whenever material changes occur to your business operations or threat environment. Per NIST SP 800-171 Rev. 3, effective risk assessments account for threat frequency, vulnerability severity, and the potential impact on affected individuals.

Access Controls and Multi-Factor Authentication

The FTC Safeguards Rule mandates Multi-Factor Authentication (MFA) for any individual accessing customer information systems from outside your internal network. For any user accessing systems containing covered data regardless of location, MFA is required unless you have documented equivalent compensating controls approved by your Qualified Individual. For tax preparers using cloud-based tax preparation platforms, this requirement effectively mandates MFA across your entire workflow. See our guide on implementing two-factor authentication for tax professionals for step-by-step setup instructions.

The 5,000-Record Threshold: Additional Obligations

Tax preparers who maintain customer information on more than 5,000 individuals face two additional obligations beyond the baseline nine elements: annual penetration testing by a qualified independent third party, and biannual vulnerability assessments of all systems that process or store covered customer information. Many mid-size tax practices reach this threshold faster than expected—a firm that has operated for five years and retains prior-year client records for audit defense purposes can easily accumulate records for tens of thousands of individuals. See our guide to penetration testing to understand what a qualifying independent assessment involves and how to select a qualified vendor to perform it.

FTC Safeguards Rule Penalties: What Non-Compliant Tax Preparers Face

The consequences of failing to comply with the FTC Safeguards Rule are significant and span multiple dimensions—regulatory, legal, operational, and reputational. Tax preparers who view compliance as optional should carefully evaluate the full scope of exposure they are accepting before making that determination.

Federal Civil Penalties

The Federal Trade Commission can impose civil penalties of up to $50,120 per violation (the 2025 inflation-adjusted figure under 15 U.S.C. § 45). Each failure to implement a required safeguard can constitute a separate violation—a firm missing multiple elements of its information security program can face penalties across each deficiency simultaneously. For firms under an FTC consent order, ongoing violations carry a separate daily penalty rate of up to $43,792 per day until the violation is remediated and verified by the FTC.

Loss of IRS E-File Access

The IRS can suspend or revoke a tax preparer's Electronic Filing Identification Number (EFIN) following a data breach or demonstrated failure to protect client data under IRS Publication 4557. Losing EFIN access prevents your firm from filing returns electronically—a severe operational disruption that can effectively shut down your practice during peak tax season. See our detailed guide on protecting your EFIN to understand the specific steps required to maintain access and what to do if your EFIN is compromised.

Private Civil Litigation

Clients whose data is exposed in a breach can pursue civil lawsuits against your firm for negligence, breach of fiduciary duty, or violations of state consumer protection laws. While the Gramm-Leach-Bliley Act does not itself create a private right of action, plaintiffs have successfully litigated state law claims arising from GLBA-covered data breaches. The average cost of defending even a favorable data breach lawsuit routinely exceeds the cost of building a compliant security program from the ground up.

Circular 230 Professional Consequences

Under Circular 230 §10.21, tax practitioners have affirmative duties related to client data. Failure to implement adequate security measures—particularly when that failure results in unauthorized disclosure of client information—can trigger disciplinary proceedings before the IRS Office of Professional Responsibility, potentially resulting in suspension or disbarment from practice before the IRS. These professional consequences are distinct from FTC penalties and can occur independently of any federal civil enforcement action.

Reputational Damage

FTC enforcement actions are public record. A consent decree or settlement announcement naming your firm publicly identifies you as having failed to protect client financial data. For tax preparers whose business depends on client trust and professional referrals, this type of public disclosure can be more damaging long-term than any monetary penalty. Unlike a fine you can pay and move past, a public enforcement record persists in search results and professional databases for years after the underlying issue is resolved.

How the FTC Safeguards Rule Aligns with IRS Publication 4557

Tax preparers navigating regulatory compliance frequently encounter two overlapping frameworks: the FTC Safeguards Rule and IRS Publication 4557, Safeguarding Taxpayer Data. Understanding how these frameworks relate to each other allows you to build a single, unified compliance program rather than maintaining separate documentation sets for each regulator.

IRS Publication 4557 requires all tax preparers—regardless of practice size—to create and maintain a Written Information Security Plan (WISP). This requirement applies even to solo practitioners preparing a single return for compensation. The WISP must document your data security policies, procedures, and safeguards in written form that can be produced during an IRS examination or a breach investigation.

The FTC Safeguards Rule's nine-element Information Security Program requirement substantially overlaps with what a thorough WISP contains. Firms that build a WISP addressing all nine FTC elements—risk assessment, access controls, encryption, incident response, employee training, service provider oversight, and the rest—will simultaneously satisfy the IRS Publication 4557 documentation requirement. The most efficient approach is to build one document that satisfies both frameworks from the outset, rather than treating them as separate compliance workstreams.

Key distinctions between the two frameworks worth understanding:

• Scope of applicability: IRS Publication 4557 applies to all paid tax preparers regardless of return volume. The FTC Safeguards Rule applies to firms significantly engaged in financial services—a category the FTC treats as including all tax preparation firms.
• Enforcement authority: IRS Publication 4557 is enforced by the IRS, which can revoke EFIN access and refer violations to the Office of Professional Responsibility. The FTC Safeguards Rule is enforced by the FTC, which imposes civil monetary penalties directly.
• Specificity of requirements: The updated FTC Safeguards Rule is more prescriptive than IRS Publication 4557, specifying exact controls like MFA mandates, encryption standards, and penetration testing thresholds for larger firms.

For detailed guidance on building a WISP that satisfies both sets of requirements, see our WISP templates for accountants and our complete guide on IRS WISP requirements for tax professionals.

Service Provider Oversight: A Commonly Overlooked FTC Obligation

The FTC Safeguards Rule places explicit responsibility on tax preparers for the security practices of third-party service providers who access or process their customer data. This means your compliance obligation extends beyond your own internal systems to every vendor in your technology stack that touches client financial information.

For a typical tax practice, covered service providers commonly include cloud-based tax preparation software platforms, document storage and scanning services, IT support contractors with remote access to client systems, cloud storage services used to share client documents, and email service providers. If any of these vendors experience a breach involving your client data, your firm may face regulatory exposure if you cannot demonstrate that you selected the vendor with appropriate due diligence and contracted for required security protections.

The FTC Safeguards Rule requires tax preparers to: select service providers that maintain appropriate safeguards; require by contract that those providers implement and maintain those safeguards; and periodically assess the adequacy of their security controls. In practice, this means requesting SOC 2 Type II reports or equivalent security certifications from your key vendors, reviewing their breach notification procedures, and ensuring your data processing agreements include provisions requiring notification of security incidents affecting your customers' data.

Review your existing vendor relationships against the tax season cybersecurity checklist to identify gaps in your service provider oversight program. When you identify a vendor that cannot demonstrate adequate security controls, the FTC Safeguards Rule requires you to either work with that vendor to remediate identified gaps or select an alternative provider. Continuing to use a vendor with known security deficiencies after identifying those deficiencies creates compounding compliance and liability exposure for your firm. For a deeper look at how cyberattacks on tax firms frequently originate through third-party vendor compromises, see our analysis of recent incidents affecting the tax profession.

The Verizon 2025 Data Breach Investigations Report found that third-party involvement was a factor in a significant share of confirmed breaches across industries, underscoring the real-world risk that inadequate vendor oversight creates for tax practices of all sizes. Your WISP should include a dedicated section on vendor management procedures—both for initial vendor selection and for ongoing periodic review—to document your compliance with this often-overlooked element of the FTC Safeguards Rule.