The FTC Safeguards Rule and email security: what it requires

If your business arranges loans, prepares tax returns or offers other financial services, the FTC Safeguards Rule probably applies to you, and much of the customer information it protects moves through email. This guide explains what the amended rule says, which parts touch email, and how common email controls line up with them.

This is general information, not legal advice. Whether and how the rule applies depends on your business, so check with a qualified adviser.

What is the FTC Safeguards Rule?

The Safeguards Rule is 16 CFR Part 314. It implements part of the Gramm-Leach-Bliley Act and sets standards for "administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information."

At its core, you must "develop, implement, and maintain a comprehensive information security program" that is written down and "appropriate to your size and complexity." Section 314.4 lists the elements that program must include.

Key dates

Who does the Safeguards Rule cover?

It covers "financial institutions" under the FTC's jurisdiction, meaning businesses engaged in financial activities that aren't overseen by another federal regulator for this purpose. The rule's own examples include mortgage lenders, payday lenders, finance companies, mortgage brokers, collection agencies, "credit counselors and other financial advisors, tax preparation firms," non-federally insured credit unions and investment advisors that don't have to register with the SEC.

Car dealers are covered too. The FTC's FAQ for auto dealers says dealers "who finance (or facilitate the financing of) automobiles for consumers are financial institutions," as are dealers that lease cars for longer than 90 days.

The FTC stresses that "what matters are the types of activities your business undertakes, not how you or others categorize your company" (FTC guidance). The rule also applies to customer information you receive from other financial institutions.

Which Safeguards Rule requirements affect email?

Email isn't named in the rule. It doesn't need to be: if client returns, loan documents or account numbers pass through your mailboxes, your email system handles customer information. The rule defines an "information system" to include systems "containing customer information or connected to a system containing customer information."

These are the elements most relevant to email:

Multi-factor authentication (314.4(c)(5))

You must "implement multi-factor authentication for any individual accessing any information system," unless your Qualified Individual approves "reasonably equivalent or more secure access controls" in writing. MFA means at least two of: something you know (a password), something you have (a token) or something you are (a biometric).

For email, that means MFA on every mailbox and admin account, and turning off older sign-in methods that skip it. See SMTP AUTH and basic auth retirement in Microsoft 365.

Encryption in transit and at rest (314.4(c)(3))

You must "protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest." If that's infeasible, you may use "effective alternative compensating controls reviewed and approved by your Qualified Individual."

Standard email encryption between servers (STARTTLS) is usually opportunistic: if the other server doesn't support it, a message can travel unencrypted. MTA-STS lets your domain require TLS for inbound mail from senders that support it. For client documents, a secure portal or message-level encryption is often the safer route. Our guides to STARTTLS and email encryption types explain the options.

Access controls and logging (314.4(c)(1) and (c)(8))

You must limit authorized users to the customer information they need, and "monitor and log the activity of authorized users." In practice, that means individual mailboxes rather than shared logins, mailbox audit logging and sign-in alerts. Watch for malicious inbox rules and auto-forwarding, a common sign of a compromised account.

Training (314.4(e))

You must give staff "security awareness training that is updated as necessary to reflect risks identified by the risk assessment." For most firms, phishing and payment fraud are the top email risks. Our security awareness training guide covers what to include.

Service provider oversight (314.4(f))

You must take "reasonable steps to select and retain service providers" that can protect the information, require safeguards by contract and periodically assess them. Your email host, spam filter, archiving tool and IT provider are all service providers that see customer information.

Incident response and notification (314.4(h) and (j))

You need a written incident response plan. Separately, if a "notification event" involves the information of at least 500 consumers, you must notify the FTC "as soon as possible, and no later than 30 days after discovery," using the FTC's online form. The FTC warns that "your report may be made public."

A notification event is "acquisition of unencrypted customer information without the authorization of the individual." The rule presumes that unauthorized access means acquisition "unless you have reliable evidence showing" otherwise. A compromised mailbox full of unencrypted client files can therefore become a reportable event. Our guide to signs an email account is compromised helps you spot one early.

What does the under-5,000-consumer exception cover?

Section 314.6 says four requirements "do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers":

So a small tax practice still needs MFA on email, encryption and training. It just has fewer documents to produce, and the specific testing schedule in 314.4(d)(2) doesn't apply.

How do email security controls map to the rule?

Use this table as a starting point for your written program. Each control supports a requirement; none satisfies it alone.

What should you ask your email security provider?

Because 314.4(f) requires oversight, ask every email provider, in writing:

1. Where is mail processed and stored?
2. How long are message history and quarantined messages kept, and who can see them?
3. Is mail encrypted in transit, and what happens when the other server doesn't support TLS?
4. Do admin accounts require MFA?
5. What certifications or audit reports do you hold, if any?
6. Will you sign a data processing agreement?
7. How do you tell us about a security incident that affects our data?

For reference, iBlockSpam's answers are on our security page: mail is processed in the United States, message history is kept for 30 days, mail moves over TLS when the other server supports it, and admin accounts use MFA. We hold no SOC 2 or ISO certification. Our data processing agreement, still a draft pending legal review, sets out the proposed contract terms. iBlockSpam can be one safeguard in your program; it doesn't make your business compliant.

Next steps

1. Confirm whether your activities make you a covered financial institution, and count how many consumers' information you hold.
2. Turn on MFA for every mailbox and admin account, and record any exception your Qualified Individual approves.
3. Check your domain's email security with the free Email Health Check and MTA-STS Checker.
4. Add your email providers to your service provider list and send them the questions above.
5. Tax professionals should also read IRS Publication 4557 and our page for accounting firms. For the wider basics, see the small business email security checklist.

See more buying guides.