FTC Safeguards Rule Amendments

The FTC Safeguards Rule, part of the Gramm-Leach-Bliley Act (GLBA), was originally adopted in 2003 and significantly amended in 2021, with most provisions enforced from June 9, 2023. The rule requires non-bank financial institutions to develop, implement, and maintain a comprehensive information security program to protect customer data.The 2021 amendments modernize the rule to address evolving cyber threats, introducing more prescriptive requirements such as multi-factor authentication, encryption, and risk assessments. It applies to non-bank financial institutions, including mortgage brokers, auto dealers, loan servicers, investment advisors, payday lenders, and tax preparers under FTC jurisdiction. These entities must establish robust customer due diligence protocols as part of their comprehensive information security programs to verify customer identities, assess risk profiles, and maintain ongoing monitoring to protect sensitive financial information and ensure regulatory compliance.