The FTC Safeguards Rule applies to your dealership if it finances, arranges financing for, or leases vehicles for longer than 90 days to people buying for personal use. FTC staff guidance for dealers says that covers “most automobile dealers who finance or lease automobiles.”
Last updated: November 13, 2026
Fair question. You sell cars. You fix them. You’re not a bank, and a federal rule written for financial institutions sounds like it belongs to somebody with a vault.
If your store arranges financing or writes leases for retail customers, I’d assume you’re covered, and the FTC staff’s own guidance points the same way. The reason isn’t the showroom. It’s the F&I office, because the rule cares about what happens after a customer sits down and signs a credit application, and once your store arranges that loan or writes that lease, the rule treats your store as a financial institution.
I’m going to stay on the applicability question here: who’s in, who might be out, and what changes for a smaller store. The program’s requirements have their own post, our FTC Safeguards Rule requirements walkthrough, and the way we run it for dealers is on our dealership compliance services page. None of this is legal advice, so the close calls go to your attorney.
What Makes a Car Dealership a “Financial Institution”?
Under the Safeguards Rule, a financial institution is any business “engaging in an activity that is financial in nature or incidental to such financial activities” under section 4(k) of the Bank Holding Company Act. Lending money counts. So does brokering a loan, and so does leasing for longer than 90 days. A dealership doesn’t have to be a bank to qualify. In the rule’s words, an institution “significantly engaged in financial activities” is a financial institution.
The regulation doesn’t leave car dealers to guess, either. One of the examples written into 16 CFR 314.2 reads: “An automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis for longer than 90 days is a financial institution with respect to its leasing business.”
Financing gets the same treatment. The FTC staff’s Safeguards Rule FAQ for automobile dealers says dealers “who finance (or facilitate the financing of) automobiles for consumers are financial institutions for purposes of the Safeguards Rule.” Look at that second verb. You don’t have to hold the paper. The same FAQ says that when you “provide financing to or arrange financing for the consumer,” that consumer becomes your customer.
Arrange retail financing or leases? You’re in.
Which Parts of a Deal Put Your Store in Scope?
Any deal where your store extends credit, arranges credit, or writes a lease longer than 90 days for an individual’s personal use makes that buyer your customer and their file customer information. The trigger is the financing activity, not the size of the store.
- Indirect lending, where the deal goes to a bank or a captive. The FTC’s dealer FAQ covers a dealer who will “arrange financing for the consumer,” and this is exactly that.
- Buy-here-pay-here paper you hold yourself. Not even close.
- Leases with a term longer than 90 days. The rule’s own example is a dealership’s leasing business.
- The applicant who walks is different. The rule calls anyone who applies for personal credit a consumer, but FTC staff tie customer information to the people you finance or lease to, and list “applications you approved for financing or leasing” as always covered.
- What doesn’t count by itself is the name and address you take from every buyer. FTC staff say that “is not consumer information or customer information.”
- And the network those files sit on? The rule reaches systems “connected to a system containing customer information,” which can pull in the DMS, the file server, and the shared folder your scanner drops deal jackets into.
One financed retail deal settles it.
Can a Dealership Fall Outside the Rule?
A few can, on paper. A store that sells only for cash, writes no leases, and sends every buyer off to find their own financing never extends or arranges credit. The FTC’s dealer FAQ says a buyer who “buys an automobile from you with cash” or “arranges financing elsewhere” never becomes a consumer under the Privacy Rule, and it adds that “the Safeguards Rule only applies to ‘customer information.'” With no customers in that sense, the rule has no customer information to protect at that store.
I’ve been around dealerships since I worked a sales floor in the late ’90s, and I can’t picture a franchised new-car store that runs that way.
Business-purpose deals are a different story, because the rule only protects people who borrow or lease for personal, family, or household use. That question matters most at heavy truck stores, and it has its own post: does the FTC Safeguards Rule apply to heavy truck dealerships. For a car store that finances or leases to families, the answer is simpler.
It’s yes.
What Does the 5,000-Consumer Exception Change?
Less than you might hope. 16 CFR 314.6 says: “Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.” That’s four paragraphs of 16 CFR 314.4. It isn’t an exemption from the rule.
| What the rule asks for | Where it sits | Under 5,000 consumers |
|---|---|---|
| A Qualified Individual who oversees the program | 314.4(a) | Still required |
| A program based on a risk assessment, reassessed periodically | 314.4(b), (b)(2) | Still required |
| That risk assessment in writing, with set criteria | 314.4(b)(1) | Exempt |
| Safeguards such as access controls, encryption, multifactor authentication, secure disposal, and activity logging | 314.4(c) | Still required |
| Regular testing or monitoring of key controls | 314.4(d)(1) | Still required |
| Continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months | 314.4(d)(2) | Exempt |
| Security awareness training for staff | 314.4(e) | Still required |
| Oversight of service providers | 314.4(f) | Still required |
| Evaluating and adjusting the program | 314.4(g) | Still required |
| A written incident response plan | 314.4(h) | Exempt |
| A written report to the board at least once a year | 314.4(i) | Exempt |
| Telling the FTC, within 30 days of discovery, about a breach of unencrypted information involving at least 500 consumers | 314.4(j) | Still required |
Now look at what you’re counting. Read it twice. The exception turns on how many consumers your customer information covers, not on how many cars you sell. If your store finances or leases 100 retail deals a month and keeps those files, it passes 5,000 in a little over four years. That’s why I think the exception really fits the small used-car lot with a handful of financed deals, and not a franchised store with a busy F&I office.
Smaller doesn’t mean exempt. It means less paper.
Covered Means Monitored All Year
Asked the usual way, “does it apply to us” sounds like a box you check once. The rule doesn’t read that way. It asks you to “regularly test or otherwise monitor the effectiveness of the safeguards’ key controls,” to perform additional risk assessments periodically, to adjust the program when the testing or your operations change, and, above the 5,000 line, to report to the board in writing at least once a year.
That’s a program somebody runs all year. A binder filled in once and put on a shelf doesn’t do it, which is the point of our post on why your compliance binder was accurate the day you printed it.
When we run compliance for a dealer, the annual board report is part of what we deliver, and so are annual human-led penetration testing rather than automated scans, semi-annual vulnerability monitoring, a compliance scanning tool we built ourselves, and a risk rating for every vendor connected to the store’s systems. We manage the technology for 2,000-plus dealerships, so we do that next to the IT and dealership cybersecurity services that make the controls work in the first place. If you’d like to see what goes in front of the board, our Safeguards Rule board report template breaks it into sections.
Whenever things aren’t going the way I want, I ask myself, what am I not doing? A Safeguards program deserves that question more often than once a year. The answer is what gives a dealer peace of mind, so the store can focus on sales and service.
What Does a Small Store Still Owe?
A store under the 5,000 line still runs a real security program, just a lighter one. FTC staff say your safeguards should be “appropriate for your size and complexity,” so the program can be scaled to a single rooftop. It still needs someone in charge, working controls, and a plan for vendors and breaches.
- A Qualified Individual. That person can work for you or for a service provider, but if it’s an outside firm, the rule says you “retain responsibility for compliance” and name a senior person at the store to oversee them.
- Multifactor authentication for anyone accessing your information systems, unless the Qualified Individual approves an equivalent control in writing.
- Encryption of customer information at rest and in transit over external networks, or compensating controls your Qualified Individual approves where encryption isn’t feasible.
- Do you know when an old deal jacket gets shredded? The rule wants customer information disposed of no later than two years after you last used it, unless you need it for business operations or another legitimate purpose, or the law requires you to keep it.
- Training that changes when your risks change.
- Vendor contracts that require safeguards, and a periodic look at whether those vendors actually keep them.
- Somebody who already knows the FTC breach report exists: 500 consumers, unencrypted information, 30 days from discovery.
Our FTC Safeguards Rule checklist lays it out as a PDF you can download. Exempt or not, I’d still keep a written incident response plan, and our incident response plan template is a place to start.
What Dealers Ask Me About Coverage
We arrange financing but never hold the paper. Does that still count?
Do people who applied for credit and didn’t buy count toward 5,000?
We’re one rooftop with a small F&I office. What can we actually skip?
Is every lease a trigger, or only some?
If we’re covered, do we have to report every breach to the FTC?
Find Out Where Your Store Stands
If you’re not sure whether your program would hold up, start with our complimentary IT and cybersecurity assessment. It looks at your technology, your cybersecurity posture, and your compliance standing together, and a written report goes to the people who need to see it.
Covered isn’t a verdict on your store. It’s just the job.