Assurbyte Book a free call
Menu

FTC Safeguards Rule for Bookkeepers: Does It Apply to You?

· Assurbyte

Reading glasses resting on a laptop beside a pen, with the headline: Bookkeepers: does the rule apply to you?

Short answer: the FTC Safeguards Rule for bookkeepers comes down to what you actually do, not your job title. The rule doesn't mention bookkeepers by name. It does name "an accountant or other tax preparation service" that completes income tax returns. So if you prepare returns, even a handful each spring, plan as if the rule covers you. If you only keep books, the answer is less clear, and that's a question for an attorney. Either way, the client data on your laptop is worth protecting, and the steps are the same.

Let's unpack that, minus the legalese.

What is the FTC Safeguards Rule, in plain English?

The FTC Safeguards Rule is a federal rule from the Federal Trade Commission (FTC). It says certain businesses that handle people's financial information must protect it with a written security plan and some basic safeguards. Think of it as a house rule: if you hold the spare keys to people's money lives, you need a plan for where the keys live, who can touch them, and what you'll do if one goes missing.

The written plan is often called a WISP, short for written information security plan. The rule itself is 16 CFR Part 314 on eCFR, the government's official online copy of federal rules.

Does the FTC Safeguards Rule apply to bookkeepers?

Here's where it gets a little twisty. The rule applies to "financial institutions," and it uses that phrase much more broadly than banks. A business counts if it's "significantly engaged" in activities a banking law treats as financial (definitions in 16 CFR 314.2).

The rule then gives a list of examples. Mortgage brokers are on it. So are check cashers, appraisers and credit counselors. And so is "an accountant or other tax preparation service that is in the business of completing income tax returns." The list of financial activities it points to, at 12 CFR 225.28, includes "tax-planning and tax-preparation services."

What you won't find in either place is the word "bookkeeping." We searched. (Thrilling stuff, we know.)

So you'll see blog posts online that say every bookkeeper is "squarely" covered. Others say it's unclear. The honest answer is that the rule's text doesn't settle it for books-only work. Most bookkeepers fall into one of three situations.

Where do you fit under the FTC Safeguards Rule for bookkeepers?

1. You keep books and prepare tax returns. This is the easy one. Preparing returns matches the rule's named example. Plan as a covered business. Also, if you prepare federal returns for pay, the IRS says you need a PTIN (PTIN requirements on IRS.gov). A PTIN is your preparer ID number. Its renewal form asks you to acknowledge the written-plan requirement. Our post on Form W-12 line 11 walks through that box.

2. You keep books and run payroll, but never touch a tax return. This is the gray zone. Whether books-only work counts as a "financial activity" under the rule is a legal question we can't answer for you. One more wrinkle to raise: the rule protects "customer information" about consumers, meaning people getting a financial service for personal, family or household use. If all your clients are businesses, ask how that affects you. Get a written answer from an attorney who works with small firms, and keep it on file.

3. You do books for a tax or accounting firm. If a covered firm sends you its clients' information, you likely fit the rule's definition of a "service provider" (16 CFR 314.2). The firm then has to choose providers that can protect that data, require safeguards in a contract, and check in on them over time (vendor oversight in 16 CFR 314.4(f)). Translation: even if the rule isn't knocking on your door, your client may be. Expect questions about MFA, backups and how you store files.

Why does a bookkeeper's data need protecting either way?

Forget the rule for a second. Look at what's in your files: bank statements, payroll records, Social Security numbers, sometimes login details for client accounts. That's a jackpot for a scammer. A single phished email password can let someone read every statement you've ever been sent.

The real-world worries are practical ones:

  • A breach. Stolen client data means awkward calls, lost trust and hours of cleanup.
  • Fraud in your clients' names. Bank details and SSNs can be used to open accounts or file fake tax returns.
  • Insurance questions. If you carry cyber insurance, insurers may ask about things like MFA, backups and a written security plan.

None of that cares whether you're a bookkeeper, a preparer or both.

What would a written security plan cover for a bookkeeper?

If you're covered, or you just want to be ready, the rule's core list lives in 16 CFR 314.4. In plain words, it asks you to:

  • Name one person in charge of the plan. For a solo bookkeeper, that's you. Congratulations on your promotion.
  • Look at your risks. Where does client data live? Laptop, cloud, email, that filing cabinet?
  • Lock things down. Limit who can see what, encrypt client data (scramble it so it's unreadable without a key), and use MFA. MFA means multi-factor authentication: a second check, like a code on your phone, on top of your password.
  • Train your people, including that part-time helper you bring on in March.
  • Keep an eye on your vendors, like your cloud storage and accounting software.
  • Have a plan for when something goes wrong, and update the whole thing as your office changes.

Small offices get a little relief. If you hold customer information on fewer than 5,000 consumers, a few parts don't apply, such as the written risk assessment and the written incident response plan (16 CFR 314.6). The rest still does. For a fuller walkthrough, see what a WISP should include.

You don't have to start from a blank page, either. The IRS offers a free, plain-language guide, IRS Publication 4557, Safeguarding Taxpayer Data, and a written-plan template in IRS Publication 5708. They're written for tax pros, but the steps fit a bookkeeping office just fine. Our Pub 4557 checklist turns the first one into a 30-minute sitting.

Six parts of a bookkeeper's written security plan: one person in charge, a look at your risks, locking things down with limited access, encryption and MFA, staff training, vendor oversight, and a plan for when something goes wrong.

FAQ

Does the FTC Safeguards Rule name bookkeepers?

No. The rule's examples name "an accountant or other tax preparation service that is in the business of completing income tax returns," but not bookkeeping on its own. Coverage depends on the activities you actually perform.

I prepare a few tax returns a year. Does that count?

Preparing returns matches the rule's named example, so plan as a covered business. If you prepare federal returns for pay, the IRS also says you need a PTIN.

I only do books for businesses. Am I covered?

The rule's text doesn't settle that clearly. The rule protects information about consumers who get financial services for personal, family or household use. Ask an attorney for a written answer based on your services.

Do bookkeepers need a WISP?

If you're covered, yes: the rule requires a written information security program. If you're not sure, a written plan is still a practical way to protect client data and answer client or insurer questions.

Want a quick read on where you stand?

Take the free Small Office Security Checkup. It takes a few minutes and shows which basics you already have and which gaps to look at first. No pressure, and no tech degree needed.

This post is general information, not legal advice. For a ruling on your specific practice, talk to an attorney.

Sources