Most dealerships think of cybersecurity as an IT problem. The FTC treats it as a financing problem. A dealer that finances cars, arranges financing, or leases for more than 90 days is a “financial institution” under the FTC’s Safeguards Rule. That covers most dealers, because the rule looks at what the business does, not how it describes itself.

What Is Required

A dealer in scope must maintain a comprehensive written information security program. The FTC’s rule spells out the elements, including:

1. A designated Qualified Individual who runs the program
2. A written risk assessment
3. Access controls, encryption of customer information, and multifactor authentication
4. Ongoing monitoring, or annual penetration testing plus vulnerability assessments every six months
5. Security awareness training for staff
6. Oversight of service providers that touch customer data
7. A written incident response plan
8. At least annual written reporting to the dealership’s board or owners

The obligation attaches to anyone who obtained financing through the dealer, including loans the dealer arranged and then sold. The FTC says the dealer must keep protecting that information for as long as it holds it.

What Is Not Required

Not every dealer has to do everything above. A dealer that holds customer information on fewer than 5,000 consumers is exempt from items 2, 4 (the testing piece), 7, and 8. Former customers count toward that number, so a store with a long history can be over the line without realizing it.

Also, the FTC’s dealer FAQ is staff guidance, not binding law. The rule itself is what a dealer is held to. Beware anyone who tells your client the FTC mandates a particular product or vendor. It does not.

The Part Your Client Will Not Expect

If a breach exposes unencrypted information on 500 or more consumers, the dealer must notify the FTC within 30 days of discovery. That requirement has been in effect since May 2024. Most dealers have a plan for the first 48 hours of an incident. Few have one that accounts for a regulator.

What to Do This Week

1. Ask whether the dealership finances or leases for more than 90 days. If yes, the Rule almost certainly applies.
2. Ask who the designated Qualified Individual is. If nobody knows, that is the finding.
3. Ask to see the written security program and the last risk assessment. Whether a document exists is a fair first question.
4. Ask whether the dealer is under the 5,000-consumer line, and how they counted.

Line for the Email

Banker version (default):

“If your dealership finances or leases cars, the FTC’s Safeguards Rule almost certainly applies to you, and it comes with a 30-day clock to notify the FTC if customer financing files are exposed. Before anything goes wrong, or if something already has, call me first. I can put you in touch with people who do this work.”

CPA variant (use only if the post goes to CPAs):

“If your dealership finances or leases cars, the FTC’s Safeguards Rule almost certainly applies to you. If you are not sure you have the written program it calls for, loop me in before you close the loop with your IT vendor, and I will help you find the right people to check it.”

References

• FTC, Automobile Dealers and the FTC’s Safeguards Rule: Frequently Asked Questions (June 2025, page last modified July 10, 2025): https://www.ftc.gov/business-guidance/resources/automobile-dealers-ftcs-safeguards-rule-frequently-asked-questions
• FTC, FTC Safeguards Rule: What Your Business Needs to Know: https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
• 16 CFR § 314.6 (exceptions for institutions with customer information on fewer than 5,000 consumers): https://www.ecfr.gov/current/title-16/part-314