What Is the FTC Safeguards Rule?

The FTC Safeguards Rule (updated and effective June 9, 2023) requires financial institutions to develop, implement, and maintain a comprehensive information security program. This is not optional — it is a federal mandate with real enforcement consequences.

The rule applies to a broad range of businesses that handle consumer financial data, far beyond what most people consider "financial institutions."

Who Must Comply with the FTC Safeguards Rule?

The Safeguards Rule applies to all "financial institutions" under the FTC's jurisdiction, including:

CPA firms and accounting practices — all sizes, including solo practitioners
Tax preparation services — including seasonal preparers
Financial advisors and planners — RIAs, fee-only advisors, broker-dealers
Mortgage brokers and lenders — including loan officers
Real estate settlement services — title companies, escrow agents
Auto dealerships — any dealer that arranges financing
Payday lenders and collection agencies
Investment companies not regulated by the SEC

If your business handles consumer financial information in any capacity, you likely must comply.

→ Check your compliance exposure — compare cyber insurance quotes free

Key Requirements of the Safeguards Rule

The updated rule requires these specific security measures:

Designate a Qualified Individual to oversee your security program
Conduct a risk assessment identifying threats to customer information
Implement safeguards including access controls, encryption, MFA, and secure disposal
Monitor and test your security controls regularly
Train employees on security awareness and procedures
Create an incident response plan for data breaches
Assess service providers who access customer data
Report to your board (or senior leadership) on security program status

Penalties for Non-Compliance

The FTC has enforcement authority and has been increasingly active:

Fines up to $50,120 per violation (adjusted annually for inflation)
Consent orders requiring ongoing compliance monitoring at your expense
Mandatory third-party audits for years after an enforcement action
Public disclosure of enforcement actions — reputation damage to your firm
Personal liability — the FTC can pursue individual officers and directors

How Cyber Insurance Supports FTC Compliance

While cyber insurance does not replace a security program, it is a critical safety net:

Regulatory defense coverage pays legal costs if the FTC investigates or brings an enforcement action against your firm
Breach response services help you execute your incident response plan (a Safeguards Rule requirement)
Risk assessment tools provided by many carriers help you identify and address security gaps
Vendor assessment resources help evaluate third-party service providers (another requirement)
Compliance documentation — having cyber insurance demonstrates to regulators that you take data security seriously

→ Compare FTC compliance cyber insurance quotes from top carriers

Top Carriers for Safeguards Rule Coverage

Hartford: Strong regulatory defense coverage, compliance resources, competitive rates for small financial firms
Chubb: Premium coverage with dedicated regulatory defense limits, proactive compliance support
Hiscox: Affordable policies for solo practitioners and small firms, built-in regulatory defense
Cowbell: Continuous compliance monitoring with AI-driven risk assessment

Cost of Compliance Cyber Insurance

Business Type	Typical Premium
Solo tax preparer/CPA	$500–$1,200/yr
Small accounting firm	$1,200–$2,500/yr
Financial advisor/RIA	$1,000–$2,000/yr
Mortgage broker	$1,200–$2,800/yr
Auto dealership (F&I)	$2,000–$4,000/yr

The cost of a cyber insurance policy is a fraction of a single FTC fine — and far less than the cost of an enforcement action.

→ See what your business would pay — get a free compliance quote