FTC Safeguards Rule for Mortgage Brokers: Requirements, Exams and Security Testing
Mortgage brokers and non-bank lenders hold some of the most sensitive data any small business can collect: Social Security numbers, bank statements, tax returns, pay stubs and credit reports. That is why the FTC Safeguards Rule applies to them, and why state regulators look at it during examinations.
This guide explains what the Rule requires of a mortgage company, what a state examiner may ask about, and how to handle the security testing part, with a focus on the systems borrowers use every day: your website, your application forms and your document upload portal.
Does the Safeguards Rule apply to mortgage brokers?
Yes. The Safeguards Rule (16 CFR Part 314) applies to non-bank “financial institutions” under FTC jurisdiction, and the FTC’s own business guidance lists mortgage brokers among its examples, alongside lenders, tax preparers and other non-bank financial companies.
Size matters for only part of the Rule. Firms that maintain customer information on fewer than 5,000 consumers are exempt from four specific requirements (16 CFR 314.6): the written risk assessment, the testing requirement, the written incident response plan and the annual report to the board. Everything else, including encryption and multi-factor authentication, still applies.
What state examiners look at
Safeguards compliance is not only an FTC topic. In Texas, for example, the examination worksheet for mortgage companies published by the Texas Department of Savings and Mortgage Lending includes a section titled “Information Security Program / Safeguards Rule”. Among other items, it asks whether the company:
- designates a qualified individual to coordinate the plan
- performs a risk assessment that identifies internal and external risks
- if it has 5,000 or more consumers, has a written incident response plan and provides an annual report from the qualified individual to the board or senior staff
- if it has 5,000 or more consumers, performs penetration tests and vulnerability assessments, and updates its program to reflect their results
Other states have their own examination procedures. The practical lesson is the same everywhere: an examiner will expect to see documents, not just good intentions.
The Rule’s requirements at a glance
| Section | What it requires | Under 5,000 consumers? |
|---|---|---|
| 314.4(a) | A Qualified Individual who oversees the program | Required |
| 314.4(b) | A risk assessment; for larger firms it must be written | Written form not required |
| 314.4(c) | Safeguards: access controls, data and system inventory, encryption in transit and at rest, secure development, multi-factor authentication, secure disposal, change management, monitoring and logging | Required |
| 314.4(d)(2) | Continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months | Exempt |
| 314.4(e) | Security awareness training and qualified staff | Required |
| 314.4(f) | Oversight of service providers | Required |
| 314.4(g) | Adjusting the program based on testing and changes | Required |
| 314.4(h) | A written incident response plan | Exempt |
| 314.4(i) | A written report to the board or a senior officer at least annually | Exempt |
| 314.4(j) | Notifying the FTC within 30 days of a security event involving 500 or more consumers | Required |
Where mortgage companies are exposed online
Loan files move through many systems, but the ones an outside attacker can reach first are the ones on the internet. For a typical broker or small lender these are:
- Your website and loan application forms. Forms that collect income, employment or Social Security numbers must submit over HTTPS and should not store data in places that are publicly reachable.
- Document upload portals. Borrowers upload bank statements and tax returns. Upload folders that allow directory listing, guessable file links or unprotected admin panels expose entire loan files.
- Login pages for webmail, your website admin area, remote access and any borrower portal. The Rule requires multi-factor authentication for anyone accessing an information system (314.4(c)(5)).
- Your email domain. Mortgage closings are a well-known target for email impersonation aimed at diverting closing funds. SPF, DKIM and DMARC records make it much harder for criminals to send email that appears to come from your domain. Our SPF, DKIM and DMARC guide explains how to set them up.
- Forgotten subdomains and old sites, such as a previous application form or a test copy of the website that is still online.
Third-party platforms you use for applications or e-signatures are part of your service provider oversight (314.4(f)). Their security is primarily their responsibility, but how your website links to them, and what your own domain exposes, is yours.
How to handle the testing requirement
If you have customer information on 5,000 or more consumers and do not run continuous monitoring, the Rule calls for:
- a penetration test at least once a year, and
- vulnerability assessments at least every six months, plus testing after material changes to your operations or systems (314.4(d)(2)).
A practical split for a small mortgage company:
- Internal systems (office computers, network, file servers): scanned by your IT provider.
- Internet-facing systems (website, forms, portals, login pages, email domain): an external vulnerability assessment every six months. See what an external vulnerability assessment covers.
- Annual penetration test: a specialist firm, scoped to your most important systems.
Keep each report, a dated letter describing scope and method, and your notes on what was fixed. That is the evidence an examiner can review, and it feeds the annual report your Qualified Individual writes under 314.4(i).
Checklist for a mortgage company
- Name your Qualified Individual in writing.
- Count the consumers whose information you maintain, so you know which parts of the Rule apply in full.
- Turn on multi-factor authentication for email, the website admin area, remote access and every system holding loan files.
- Confirm that application forms and upload portals use HTTPS and do not expose files publicly.
- Set up SPF, DKIM and DMARC for your email domain.
- Set a disposal schedule: the Rule requires disposing of customer information no later than two years after it was last used, unless an exception applies (314.4(c)(6)).
- Book the annual penetration test and two vulnerability assessments six months apart.
- File every report, letter and remediation note with your information security program.
How Nyorsoft can help
Our FTC Safeguards Rule External Assessment covers the internet-facing part of your testing: two external vulnerability assessments a year, six months apart, each with a plain-English report, a mapping to 16 CFR 314.4 and a dated assessment letter for your records. The second assessment also verifies what you fixed. It costs $2,900 per year, and we need no access to your systems.
See a sample report prepared for a fictional tax practice, which is covered by the same Rule. We do not test internal systems or perform the annual penetration test; your IT provider or a penetration testing firm handles those.
Frequently asked questions
Does the FTC Safeguards Rule apply to mortgage brokers?
Yes. The FTC lists mortgage brokers among the non-bank financial institutions covered by the Safeguards Rule. Firms with customer information on fewer than 5,000 consumers are exempt from four specific requirements, including the testing requirement, but not from the rest of the Rule.
How often does a mortgage company need a vulnerability assessment?
If the testing requirement applies to you and you do not use continuous monitoring, at least every six months, plus an annual penetration test and testing after material changes.
Do state examiners check Safeguards Rule compliance?
They can. The Texas Department of Savings and Mortgage Lending’s examination worksheet for mortgage companies, for example, includes a Safeguards Rule section that asks about the qualified individual, risk assessments and, for companies with 5,000 or more consumers, penetration tests and vulnerability assessments.
What counts as a notification event for the FTC?
The acquisition of unencrypted customer information without the authorization of the person it relates to. Unauthorized access is presumed to be acquisition unless you have reliable evidence otherwise (314.2(m)). If an event involves at least 500 consumers, you must notify the FTC as soon as possible and no later than 30 days after discovery (314.4(j)).
Does an external assessment replace the penetration test?
No. The Rule lists them as separate requirements. An external assessment covers the vulnerability assessments for your internet-facing systems; the annual penetration test is a separate engagement.
Sources
- 16 CFR Part 314 – Standards for Safeguarding Customer Information (eCFR)
- FTC: Safeguards Rule – What Your Business Needs to Know
- Texas Department of Savings and Mortgage Lending: mortgage company examination worksheet (PDF)
This article summarizes publicly available rules and guidance for general information. It is not legal advice; please rely on the official texts and your own advisors.
Not sure what your website exposes?
Our Public Website Security Check looks at your site the way an attacker does — TLS, security headers, email authentication and exposed services — and gives you a short, ranked list of what to fix.
Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team