You Are a Financial Institution Under Federal Law, Whether or Not You Feel Like One

Your custodian audits you before any regulator does. Schwab Advisor Services, Fidelity, and Pershing run their own security due diligence. So does every enterprise client and every carrier. The examiner may come once; the questionnaires come every year.

Your Chief Compliance Officer is the owner or a part-time consultant. Under ten people, no IT staff, and the person accountable for the information security program has a securities or tax background rather than a technical one. They do not need tools. They need translation - what a control does, what evidence it produces, and what to say when asked.

Your software is your control surface. Redtail, Wealthbox, Orion, Black Diamond for advisers; Drake, Lacerte, UltraTax, QuickBooks for CPAs; AMS360, EZLynx, Applied Epic for insurance. Multi-factor, logging, and data export controls are whatever the platform offers and whatever you enabled.

The loss event is a wire, not a ransom. Business email compromise against account transfer instructions and closing funds is the dominant real-world incident in this sector. It is defeated by verification procedure and dual approval - process, not product.

With an EFIN, a written security plan is not optional. The IRS states the requirement for tax professionals directly in Publication 4557.

• Antivirus and backup get called "compliance." The Safeguards Rule asks for a written program driven by a documented risk assessment with a named accountable individual. No product supplies that.
• A client wire is redirected after an attacker sits in a mailbox reading the transaction thread. The instructions arrive at exactly the right moment.
• Client tax documents move through personal Gmail or Dropbox because it was faster during filing season.
• Remote desktop is exposed to the internet "for convenience," usually set up years ago by someone who has left.
• The custodian questionnaire cannot be completed because nobody can evidence multi-factor enforcement, access reviews, or vendor diligence.
• The WISP does not exist, even though the firm has an EFIN and the IRS requirement is published.
• Vendor diligence is a folder of signed contracts with no assessment behind them.
• The 30-day Florida breach clock is assumed to be 60. It is not.

Is my three-person CPA firm a financial institution under GLBA?

Tax preparation is treated as a financial activity, and the FTC has been explicit that tax preparers are among the non-bank financial institutions covered by the Safeguards Rule. Headcount does not change that; it changes what a reasonable program looks like. See the FTC Safeguards Rule page at ftc.gov.

Is there a small business exemption in the Safeguards Rule?

Financial institutions that maintain customer information concerning fewer than five thousand consumers are exempt from certain specific elements - the written risk assessment, the incident response plan, the annual report to the governing body, and continuous monitoring or penetration testing requirements. They are not exempt from the rule. Read the exemption language directly at 16 CFR 314.6 on eCFR before relying on it.

Do insurance agencies have to comply with GLBA?

Insurance agents and brokers engage in financial activity and handle nonpublic personal information, which brings them within the Safeguards Rule's scope. Agencies licensed in New York have an additional and more prescriptive obligation under the NYDFS cybersecurity regulation.

Is the IRS WISP requirement mandatory for tax preparers?

The IRS states in Publication 4557 that professional tax preparers are required to have a written data security plan, and it is tied to maintaining an EFIN. The publication is free at irs.gov and includes a checklist you can work from.

What is Reg S-P and does it apply to a small advisory firm?

Regulation S-P governs privacy and safeguarding of customer records for SEC-registered entities, including investment advisers, and is codified at 17 CFR Part 248. The SEC adopted amendments in 2024 adding incident response program and customer notification requirements, with compliance dates staggered by firm size - verify the date applicable to your firm on sec.gov, as it differs for larger and smaller entities.

Do I need multi-factor authentication for tax software and QuickBooks?

Multi-factor authentication on systems holding customer information is an express element of the Safeguards Rule, and the IRS has pushed it hard for preparers through Publication 4557 and its Security Six guidance. Assume yes.

What cybersecurity questions will Schwab or Fidelity ask in due diligence?

Custodian questionnaires vary, but the common ground is multi-factor authentication coverage, encryption, access provisioning and review, backup and recovery testing, incident response and notification commitments, employee training, subcontractor management, and cyber insurance limits. The difficulty is rarely the answer - it is producing the evidence behind it.

Is the FFIEC Cybersecurity Assessment Tool still required?

The FFIEC has sunset the CAT. Institutions have moved toward other mappings, commonly NIST CSF. Confirm current examiner expectations directly at ffiec.gov rather than relying on older guidance still circulating.

Am I liable if a client wire is redirected by someone impersonating my firm?

Liability turns on facts, contract terms, and counsel - not on a web page. What is consistently true is that firms with a documented call-back verification procedure, dual approval on transfers, and evidence that both were followed are in a substantially different position than firms without them.

Do I have to report a breach if only Social Security numbers were exposed and no money was lost?

Yes, generally. Florida's §501.171 is triggered by unauthorized access to personal information, which includes a Social Security number, and requires notice within 30 days of determination regardless of whether a financial loss occurred. Federal obligations may also apply depending on your registration.