Most accounting and advisory firms think of compliance as something their clients worry about. Federal law sees it differently: under the Gramm-Leach-Bliley Act, tax preparers and many financial firms are "financial institutions." That brings written security obligations, breach reporting deadlines, and regulators who ask for proof.
Tax preparers and CPAs: the FTC Safeguards Rule
The FTC Safeguards Rule (16 CFR Part 314) requires covered firms to keep a Written Information Security Plan (WISP). The IRS reinforces this: its Publication 5708 provides a sample WISP for tax professionals, and Publication 4557 explains the safeguards. Core elements include:
- A named qualified individual responsible for the program
- A written risk assessment of where client data lives and what threatens it
- Multi-factor authentication for anyone accessing client information systems
- Encryption of client data in storage and in transit
- Vendor oversight: your tax software, cloud storage and IT provider
- Staff training and a written incident response plan
Since May 13, 2024, firms must also notify the FTC within 30 days of discovering a security event involving the unencrypted information of 500 or more consumers. That is separate from notifying clients under state law.
Investment advisers: Regulation S-P is now in force
The SEC amended Regulation S-P in 2024. Larger firms had to comply by December 3, 2025; smaller entities by June 3, 2026. SEC-registered advisers and broker-dealers now need:
- A written incident response program to detect, contain and assess unauthorized access to customer information
- Customer notification as soon as practicable, and no later than 30 days, after discovering a breach likely to cause substantial harm
- Service-provider oversight: due diligence, contract terms and monitoring of vendors that hold customer data
- Records that prove all of the above
Under the Florida Information Protection Act (Fla. Stat. §501.171), affected Florida residents must be notified within 30 days of determining a breach, and the Florida Attorney General too when 500 or more Floridians are affected. Federal and state deadlines run at the same time.
Where small firms fall short
The gaps are rarely technical. They are documentation gaps: a WISP downloaded once and never tailored, MFA on email but not on the tax software, no list of vendors holding client data, and no rehearsed plan for the day a mailbox is compromised during tax season. AI adds a new one: staff pasting client returns or statements into consumer AI tools that the WISP never mentions.
Do tax preparers legally need a WISP?
Yes. Tax preparers are financial institutions under the Gramm-Leach-Bliley Act, and the FTC Safeguards Rule requires a written information security program. IRS Publication 5708 provides a sample WISP for tax professionals.
When must small RIAs comply with the amended Regulation S-P?
Smaller entities had until June 3, 2026; larger firms until December 3, 2025. Covered firms need a written incident response program, customer notice within 30 days of a qualifying breach, and service-provider oversight.