{"id":6539,"date":"2026-05-19T15:14:36","date_gmt":"2026-05-19T19:14:36","guid":{"rendered":"https:\/\/verito.com\/blog\/?p=6539"},"modified":"2026-05-19T15:14:36","modified_gmt":"2026-05-19T19:14:36","slug":"wisp-for-bookkeepers-ftc-safeguards-requirements-2026","status":"publish","type":"post","link":"https:\/\/verito.com\/blog\/wisp-for-bookkeepers-ftc-safeguards-requirements-2026\/","title":{"rendered":"WISP for Bookkeepers: FTC Safeguards Requirements 2026"},"content":{"rendered":"

Federal Law Treats Bookkeepers Like Banks. Here’s What That Means for Your Practice.<\/strong><\/span><\/span><\/h2>\n

You’re at a tax and accounting conference. Coffee in hand. Someone at the booth next to you is talking about WISPs. You overhear “Written Information Security Plan” and your eyes glaze over.<\/p>\n

You’re a bookkeeper<\/a>. You don’t prepare returns. You don’t have a PTIN. None of this applies to you.<\/p>\n

That assumption could be the most expensive thing in your practice.<\/p>\n

Federal law disagrees. So does the FTC and the IRS. And so does the insurance carrier you’ll call the morning after a breach.<\/p>\n

This article walks you through what the law actually says.\u00a0<\/p>\n

\n

The Rule Most Bookkeepers Have Never Read<\/strong><\/span><\/h2>\n

If you run a bookkeeping practice, you almost certainly handle SSNs, payroll data, bank routing numbers, or business financials used for tax filings. That’s enough to put you under the FTC Safeguards Rule.<\/p>\n

The rule has been on the books since May 23, 2003<\/a>. It was strengthened on December 9, 2021 (86 Fed. Reg. 70272)<\/a>. Final compliance for the new technical safeguards was extended to June 9, 2023<\/a>. That deadline already passed.<\/p>\n

The AICPA has been telling its members for years that a significant share of small accounting and bookkeeping firms still don’t realize the rule applies to them.\u00a0<\/p>\n

\n

The FTC Safeguards Rule, In Plain English<\/strong><\/span><\/h2>\n

Start here. This is the rule that catches everyone. PTIN or no PTIN. Solo or 50-person firm. CPA, EA, or bookkeeper.<\/p>\n

The Federal Trade Commission’s Safeguards Rule, codified at 16 CFR Part 314<\/a>, requires every “financial institution” under FTC jurisdiction to maintain a written information security program. The Rule’s examples at 16 CFR 314.2(h), Example 6<\/a> list tax preparation firms as covered entities.<\/p>\n

Here’s where most bookkeepers get tripped up. The FTC’s definition of “financial institution” is broader than you’d expect. It isn’t limited to banks or lenders. It covers any business engaged in an activity “financial in nature or incidental to such financial activities.”<\/p>\n

That language is doing a lot of work. It’s the reason your bookkeeping practice sits on the same legal footing as the bank down the street, at least for data-security purposes.<\/p>\n

The rule mandates seven concrete things. Every covered firm must:<\/p>\n