A firm that prepares income tax returns is a financial institution under the FTC Safeguards Rule. Since the notification amendment took effect, that status carries a reporting duty: certain breaches must be reported to the FTC within a fixed window. This guide is about the decision itself. When a partner hears "we think someone got into the file server," what questions decide whether the firm files an FTC report, and how does the firm show its work?
For the broader program (the WISP, the Qualified Individual and vendor oversight), see the FTC Safeguards Rule vendor oversight guide. The regulation's text controls; this paraphrases it.
Is the firm covered at all?
The Rule's definition of financial institution, at 16 CFR 314.2(h), lists as an example an accountant or other tax preparation service that is in the business of completing income tax returns. The FTC's business guidance adds that coverage depends on the activities a business performs, not on what it calls itself. A pure audit and assurance firm with no tax return work should still check its activities against the definition, but most CPA firms with a tax practice should assume they are in.
The small-firm exemption in 16 CFR 314.6 does not help here. It exempts institutions holding customer information on fewer than 5,000 consumers from paragraphs (b)(1), (d)(2), (h) and (i) of section 314.4. Paragraph (j), the FTC notice requirement, is not on that list.
What is a notification event?
Section 314.2 defines a notification event as acquisition of unencrypted customer information without the authorization of the individual to whom the information pertains. Three parts of that definition do most of the work:
- Acquisition, with a presumption. The definition itself provides that unauthorized acquisition is presumed to include unauthorized access to unencrypted customer information, unless the firm has reliable evidence that acquisition did not occur or could not reasonably have occurred. "They were in the mailbox but we don't think they downloaded anything" is not enough without evidence.
- Unencrypted. Encrypted data is outside the definition, but information is treated as unencrypted if the encryption key was also accessed by an unauthorized person. Encryption at rest on a laptop helps only if the attacker did not get the credentials that open it.
- Customer information. This means any record containing nonpublic personal information about a customer of the financial institution. For a tax practice that includes client names with Social Security numbers, return copies, bank account details and income documents.
When does the 500-consumer threshold apply?
Under 16 CFR 314.4(j)(1), the FTC notice is required if the notification event involves the information of at least 500 consumers. A consumer, under section 314.2, is an individual who obtains a financial product or service for personal, family or household purposes. Counting is where firms go wrong:
- Count individuals, not returns. A joint return covers two people who each obtained the service. Dependents listed with SSNs are not clearly consumers under the definition, so record how the firm treated them and why; counting them is the conservative choice.
- Count across years. If the compromised share holds ten years of returns, count each unique person once.
- Separate business clients. Information about a corporation is not information about a consumer, but an owner's personal return data sitting in the business folder is.
- Use the affected data set, not the whole client list. If logs show exposure limited to one folder, the count is the people in that folder. If the firm cannot bound the exposure, the presumption pushes toward counting everything the account could reach.
Keep the count worksheet. It is the core evidence for the decision either way.
What is the deadline?
The firm must notify the FTC as soon as possible, and no later than 30 days after discovery. Under paragraph (j)(2), the event is treated as discovered on the first day it is known to the firm, and the firm is deemed to know of it if it is known to any employee, officer or other agent other than the person who committed the breach. A staff member who noticed odd mailbox rules and told no one may have started the clock.
Practical point: date the incident log from the first internal report, not from the day the partner learned of it or the day forensics finished.
What does the FTC notice contain?
The notice is filed electronically on the FTC's online form. Paragraph (j)(1) lists the contents:
- Name and contact information of the firm.
- A description of the types of information involved.
- The date or date range of the event, if it is possible to determine.
- The number of consumers affected or potentially affected.
- A general description of the event.
- Whether a law enforcement official has given a written determination that public notice would impede a criminal investigation or damage national security, with contact details for that official.
The FTC's guidance says the form asks for high-level information, a firm can report what it knows and update later, and reports may be made public. Write the description with that in mind: factual, short and free of client names.
Can law enforcement delay the notice?
The rule allows a law enforcement official to request an initial delay of up to 30 days following the date the notice was provided to the FTC, extendable by up to 60 more days on written request. Further delay requires FTC staff to determine that disclosure continues to impede an investigation or harm national security. The delay relates to public disclosure; it does not excuse filing the notice itself.
How does this fit with the firm's other notices?
The FTC report is one of several tracks. The FTC's own guidance says Safeguards Rule compliance does not replace obligations under other state and federal laws. A tax practice incident usually also involves:
- The IRS Stakeholder Liaison for the firm's area, so the IRS can protect affected taxpayers' accounts.
- State notices to residents and, in many states, the attorney general or another agency, under each state's breach law. See the state breach notification checklist.
- The cyber insurer, whose policy may have its own notice condition.
The first 72 hours guide puts these in time order.
How should the firm document the decision?
Even when the answer is "not reportable," write it down. A short memo should cover:
- Discovery date and how it was determined.
- Systems and data sets involved, and evidence on whether information was acquired.
- Whether data was encrypted and whether keys or credentials were exposed.
- The consumer count worksheet.
- The conclusion, who made it and the date.
- If reportable, the filing date and confirmation, and any later updates.
For firms above the 5,000-consumer exception, section 314.4(h) also requires the incident response plan to cover documentation and reporting of security events, and (i) requires the Qualified Individual's annual written report to cover security events. The memo feeds both.
Common pitfalls
- Waiting for forensics to finish. The 30 days run from discovery, not from the final report. File with what is known and update.
- Assuming encryption saves the day. If the attacker used a staff login, the data they saw was readable to them.
- Ignoring vendors. An incident at a hosting provider or portal vendor can still involve the firm's customer information. Vendor contracts should require prompt notice to the firm.
- Under-counting. Spouses on joint returns and prior-year clients add up quickly.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- Legal Information Institute, 16 CFR 314.4, Elements: https://www.law.cornell.edu/cfr/text/16/314.4
- Legal Information Institute, 16 CFR 314.2, Definitions: https://www.law.cornell.edu/cfr/text/16/314.2
- Legal Information Institute, 16 CFR 314.6, Exceptions: https://www.law.cornell.edu/cfr/text/16/314.6
- Federal Trade Commission, Safeguards Rule notification requirement now in effect: https://www.ftc.gov/business-guidance/blog/2024/05/safeguards-rule-notification-requirement-now-effect
- Federal Trade Commission, FTC Safeguards Rule: What Your Business Needs to Know: https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
Part of CORAA University · Completion and reporting: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error