Non-bank lenders got bank-grade security rules and a named person to answer for them

The week

On October 27, 2021, the Federal Trade Commission announced amendments to its Standards for Safeguarding Customer Information, known as the Safeguards Rule, issued under the Gramm-Leach-Bliley Act. The rule covers financial institutions under FTC jurisdiction, such as mortgage brokers, non-bank lenders, auto dealers that arrange financing, payday lenders and tax preparers. Banks and credit unions answer to their own regulators instead. The amendments replaced general requirements with specific ones. They named a single qualified individual to run the program and required written risk assessments, access controls, encryption, multifactor authentication, testing, logging, incident response plans and annual written reports to the board. The amended rule was published in the Federal Register in December 2021, and most new requirements carried a later compliance date.

Banks and credit unions have worked under detailed information security guidelines for two decades, set by the federal banking agencies and tested in examinations. Many non-bank firms holding the same kinds of customer data worked under a far more general standard and were rarely examined at all. The October 2021 amendments narrowed that gap. For covered firms, and for the banks and fintechs that partner with them, the rule made three distinct demands: specific technical controls, named accountability, and evidence that the program actually ran. Each lands on a different part of a small firm, and each has a different failure mode.

Specific technical controls

The amended rule named controls that had previously been left to judgment. Customer information had to be encrypted in transit over external networks and at rest, with compensating controls approved by the qualified individual where encryption was not feasible. Multifactor authentication was required for anyone accessing an information system. Firms had to inventory their data and systems, apply secure development practices to software they built, manage changes, and log and monitor user activity. They also had to dispose of customer information within two years of last use, unless a business or legal reason required keeping it. Testing had to be continuous monitoring or, failing that, annual penetration tests and vulnerability assessments every six months.

For a large non-bank lender, most of this was already in place. For a dealership group or a twelve-person mortgage brokerage, several items were new, and the work did not sit with the firm. These businesses run on hosted loan origination systems, dealer management platforms, tax software and office suites configured by a managed service provider. Encryption at rest and multifactor authentication on every system touching customer data meant vendor settings, license upgrades and contract changes. The disposal requirement was often the hardest. Many firms had kept every loan file since they opened, in systems with no retention function at all, and deleting data safely took more effort than encrypting it.

Named accountability

The rule required one qualified individual to oversee and enforce the program. That person could be an employee, an affiliate or a service provider. If the role was outsourced, the firm kept responsibility, had to designate a senior person to supervise the provider, and had to require the provider to maintain its own program. The qualified individual had to report in writing, at least annually, to the board of directors or equivalent governing body. The report had to cover the program’s overall status, compliance with the rule, and material matters such as risk assessment results, testing, incidents and recommended changes.

This changed the conversation at the top of many firms. A written report creates a record of what owners knew about their risks and what they chose to fund. For a family-owned dealership group, the “board” may be two owners, and the report may be the first time security appears as a line item they must decide on rather than an IT cost. Outsourcing the role to a managed service provider is legitimate, but it creates a conflict to manage. The provider reporting on the program’s gaps may also be the party responsible for closing them, and may sell the remedy.

The same governance reached banks indirectly. Banks that use non-bank partners for indirect auto lending, mortgage origination or point-of-sale credit share customer data with firms now under the amended rule. A bank’s third-party risk program can reasonably ask a partner who its qualified individual is and for a summary of the latest board report. Organizations should check with counsel on which regime applies to each entity, since the line between FTC and banking agency jurisdiction depends on charter and activity.

Evidence that the program ran

The third demand was documentation. Risk assessments had to be written and had to set criteria for evaluating and categorizing risks and for deciding how each would be addressed. Incident response plans had to be written. Service providers had to be selected with care, bound by contract to safeguards, and periodically reassessed. A program that existed in practice but not on paper would struggle to show compliance. A program that existed on paper but not in practice would be exposed the first time a breach or inquiry tested it.

For a firm starting from a thin base, the order of work mattered more than the volume. Naming the qualified individual came first, because everything else needed an owner. The data inventory came next, since encryption, access control and disposal all depend on knowing where customer information lives, including spreadsheets, scanned documents and email attachments. Multifactor authentication on email and remote access followed, because those are the most common entry points for small firms. Vendor contracts came after that, with each provider asked to confirm in writing how it met the specific controls. The written risk assessment and board report then described a program that existed rather than one that was planned.

Small firms also needed a realistic cadence. An annual penetration test, two vulnerability scans and one board report a year is a manageable calendar if it is set in January. It becomes an emergency if it is remembered in November. Firms that put the dates in the same compliance calendar they use for licensing renewals and fair lending reviews kept up. Firms that treated the rule as a one-time project tended to drift.

With hindsight

The FTC extended the compliance date for most new requirements to June 9, 2023, citing shortages of qualified staff and supply chain delays for upgrades. It then amended the rule again, requiring covered firms to notify the commission of security events involving the information of at least 500 consumers, effective May 2024. The amendments did what they set out to do. They made the baseline for non-bank financial firms concrete and comparable to bank practice. Multifactor authentication and encryption at rest became standard features that vendors serving dealers, brokers and tax preparers had to offer. The board reporting requirement brought security into owners’ decisions at businesses that had rarely discussed it. The firms that struggled most treated the rule as a document exercise and learned, during an incident or inquiry, that the described controls were not running.