It names a person.
And it starts a 30-day public clock.

Most likely yes — and not being a bank is exactly why. The Rule applies to nonbanking financial institutions under FTC jurisdiction, and the definition is far broader than people expect: mortgage brokers and lenders, auto dealers that arrange financing, tax preparers and accountants, financial advisors, collection agencies, check cashers, and many others "significantly engaged" in financial products or services. Banks are covered by their banking regulators instead, which is why the FTC's rule targets everyone else.

If you handle customer financial information and aren't supervised by a banking regulator, assume the Rule applies until a qualified analysis says otherwise. Confirming applicability — and which regulator oversees you — is the first thing we do, because building a program you don't need, or skipping one you do, are both expensive mistakes.

The Qualified Individual is the single named person responsible for overseeing, implementing, and enforcing your information security program — the accountability the Rule places at the center. No specific degree or title is required; what matters is real-world security know-how appropriate to your size and complexity. The role can be filled by an employee, an affiliate, or a service provider, so it can be outsourced — including to a firm acting in a fractional security-leadership capacity.

But outsourcing the role doesn't outsource the accountability: you must retain responsibility, designate a senior member of your organization to direct and oversee the Qualified Individual, and ensure they have the authority and information to do the job. A Qualified Individual who exists only on paper, or who lacks the security background, is one of the most common deficiencies the FTC finds.

Since May 13, 2024, the Rule requires notifying the FTC of a "notification event" as soon as possible and no later than 30 days after discovery. A notification event is the unauthorized acquisition of unencrypted customer information involving at least 500 consumers — and the Rule treats unauthorized access as acquisition unless you have reliable evidence it wasn't.

Two things make this sharper than many state laws. The clock starts at discovery — the first day the event is known to you or any employee, officer, or agent — so detection and escalation matter enormously. And the report, filed through the FTC's online form, is generally made public in an FTC database, required even if the event poses no apparent risk of harm. Because it can become public and the window is short, the time to build your response process is before an event — which is what tabletop exercises rehearse.

Tools are necessary but not what the Rule grades you on. The Safeguards Rule is a program and documentation standard, not a checklist of products. Even with strong technical controls, it still requires a designated Qualified Individual, a written risk assessment that drives your safeguards, a WISP documenting the whole program, periodic penetration testing and vulnerability assessments, service-provider oversight, an annual written report to your board or a senior officer, and a tested incident response plan tied to the 30-day clock.

In practice the most common findings aren't missing firewalls — they're the absence of a current WISP, no annual board report, a Qualified Individual never formally designated or lacking the right background, or a response plan never tested against the notification timeline. We close the gap between "we have good security" and "we can demonstrate a compliant program," because under this Rule the documentation and accountability are the compliance.