PROTECT · Compliance · GLBA + FTC Safeguards Rule
Financial data is protected by law — and the FTC is writing checks.
Media Express prepares Chicago-area insurance agencies, financial advisors, tax preparers, mortgage brokers, and other financial institutions for GLBA + FTC Safeguards Rule + WISP compliance. Privacy Notice, Safeguards Program, MFA rollout, incident response — ready for FTC or state audit.
↓
⚜ Plain English · Quotable
GLBA (Gramm-Leach-Bliley Act) is the U.S. federal law requiring financial institutions to protect customer nonpublic personal information. Its technical arm — the FTC Safeguards Rule — was expanded in 2021 and enforced from June 2023, requiring a comprehensive information security program with nine specific elements. It applies far more broadly than "banks": insurance agencies, financial advisors, tax preparers (via WISP), mortgage brokers, car dealers with financing, and many more. Media Express prepares Chicago-area financial institutions for GLBA/Safeguards audits and state financial-privacy audits.
💵 Who This Applies To
Financial institution is broader than you think.
The FTC defines "financial institution" broadly. If you significantly engage in financial activities, you're covered — regardless of size.
- Insurance agencies & brokers — life, health, P&C, commercial. State DOI + NAIC layers on top.
- Financial advisors, wealth managers, investment advisors — RIAs, broker-dealers.
- Tax preparers & CPAs — via IRS Pub 4557 WISP, mandatory since 2024.
- Mortgage brokers, loan officers, mortgage lenders — residential + commercial.
- Car dealers with financing — buy-here-pay-here, auto lending arms.
- Check cashers, money transmitters, wire transfer services — anyone touching money movement.
- Real estate settlement services — title companies, escrow, closing agents.
- Debt collectors, debt buyers, debt settlement firms — consumer + commercial.
💵 The Three Components
Privacy. Safeguards. Pretexting.
GLBA has three enforceable components. Most attention goes to the Safeguards Rule (technical requirements), but the Privacy Rule (notice + opt-out) and Pretexting provisions matter equally in enforcement actions.
Component 1
Privacy Rule
"Tell customers what you do with their data."
Requires clear, conspicuous Privacy Notice at account opening + annually. Explains what NPI you collect, who you share with, opt-out rights. Public on your website + delivered to each customer.
Component 2
Safeguards Rule
"Protect that data technically."
The teeth. Requires a documented Information Security Program with 9 specific elements: designated Qualified Individual, risk assessment, MFA, encryption, monitoring, incident response, training, vendor management, board reports.
Component 3
Pretexting Provisions
"Protect against social engineering."
Prohibits obtaining customer data by false pretenses. Requires policies + training against social engineering attempts. Often the enforcement angle when a breach traces to phishing.
⚠️ If You Ignore It
FTC has been writing checks.
Since the 2023 Safeguards Rule enforcement kicked in, FTC has been actively pursuing non-compliant financial institutions — especially those following data breaches.
⚠️ Real Consequences
Financial institutions without GLBA readiness face real financial and licensing exposure.
- FTC civil penalties up to $46,517 per violation (2024, inflation-adjusted)
- State attorney general enforcement in NY, CA, IL, TX, and elsewhere
- Class action lawsuits after data breach + notification
- Licensing risk — state insurance department revocations, PTIN suspension for tax preparers
- Increased cyber liability insurance premiums or non-renewal
- Loss of enterprise clients who require documented GLBA compliance
- Reputational damage — breaches are often reported locally
- NAIC-level enforcement for insurance carriers via state DOIs
⚜ How We Help
The 5-step GLBA readiness path.
Structured, phased approach with fixed pricing at every phase.
1
Free Readiness Assessment (15 min)
15-question quiz identifies GLBA scope, applicable state overlays (NY DFS 500, Illinois PIPA, NAIC), and top gaps.
2
Scope + Gap Analysis (2-3 weeks)
Maps current state against Privacy Rule, Safeguards Rule 9 elements, and applicable state financial-privacy laws. Roadmap with phased pricing.
3
Documentation + Privacy Notice (6-10 weeks)
Privacy Notice (public + customer delivery). Safeguards Program document. WISP (for tax preparers). Employee policies. Vendor management program. Website compliance section.
4
Technical Remediation (parallel)
MFA rollout, encryption at rest + in transit, audit logging, monitoring, incident response tabletops, training program launch, vendor risk assessment.
5
Ongoing Program (Retainer)
Annual risk assessment. Ongoing training. Policy updates as FTC/state rules evolve. Incident response support. Board reports.
💰 What It Costs
Fixed pricing at every phase.
Foundation for small offices. Full alignment for growing institutions. Ongoing retainer to stay compliant year-over-year.
Foundation
GLBA + WISP Starter
$4,000 – $10,000
One-time, 4-6 weeks
- Privacy Notice (public + delivered)
- WISP document (tax preparers)
- Basic Safeguards Rule alignment
- Customer opt-out procedures
- Website Privacy Rule compliance
- Employee awareness training kit
Most Institutions
Full Alignment
Safeguards Program
$15,000 – $45,000
Phased over 3-6 months
- Everything in Foundation
- Full 9-element Safeguards Program
- Qualified Individual designation + docs
- MFA + encryption + monitoring remediation
- Incident response playbook + tabletop
- Vendor management program
- State-specific overlay (NY DFS 500, IL PIPA, NAIC)
- Employee training program (year 1)
Ongoing Retainer
Managed GLBA
$1,000 – $4,000/mo
Recurring, month-to-month
- Annual risk assessment
- Ongoing training
- Policy updates as rules evolve
- Website + Privacy Notice maintenance
- Quarterly compliance review
- Board reports
- Compliance-ready hosting included
Above are typical Illinois market rates. Media Express pricing is more accessible — we build once and reuse across clients, so you don't pay for someone else's discovery work. Contact us for a personalized quote based on your exact situation.
⚜ Free Consultation →
❓ Common Questions
FAQ.
Am I a "financial institution" under GLBA?
Probably yes — the FTC definition is broad. Insurance, financial advisors, tax preparers, mortgage brokers, car dealers with financing, wire services, real estate settlement, debt collectors are all in scope.
What is the FTC Safeguards Rule?
The technical arm of GLBA. Expanded 2021, enforced from June 2023. Requires a documented information security program with 9 specific elements.
Are tax preparers covered?
Yes — via IRS Publication 4557 WISP, mandatory since 2024. Non-compliance risks PTIN suspension.
How much does GLBA readiness cost?
Foundation: $4-10k. Full Safeguards Program: $15-45k. Managed retainer: $1-4k/mo.
What are the penalties?
FTC civil penalties up to $46,517 per violation. State AG enforcement. Class actions after breaches. Licensing risk (PTIN, insurance license). Cyber insurance premium hikes.
How does this relate to state insurance regulations?
GLBA is federal minimum. States can layer on top — NY DFS 500, Illinois PIPA, California, NAIC Model Law. We layer state + federal so you meet strictest applicable standard.
📚 Related Terms
Also worth understanding.
Ready to see where you stand?
Take the free 15-question Compliance Readiness Assessment. Instant PDF report with your GLBA scope, applicable state overlays, and top-priority actions.
Media Express LLC prepares financial institutions for GLBA + FTC Safeguards Rule + state financial privacy compliance. Media Express does not perform formal GLBA audits (conducted by FTC or state financial regulators) or state insurance department examinations.