Penetration Testing for Non-Bank Lenders Under the FTC Safeguards Rule

If you lend money in the US and are not a bank or credit union, the FTC Safeguards Rule (16 CFR Part 314) very likely applies to you. Section 314.4(d)(2) gives you two ways to test your systems: run effective continuous monitoring, or carry out a penetration test every year and a vulnerability assessment at least every six months. Lenders that hold customer information on fewer than 5,000 consumers are exempt from that testing clause, but not from the rest of the rule. This guide covers who is in scope, what the testing clause says word for word, and how to plan a year of testing around it.

Does the FTC Safeguards Rule cover your lending business?

The rule applies to every financial institution the Federal Trade Commission has jurisdiction over. A business is a financial institution if it is significantly engaged in an activity that is financial in nature under section 4(k) of the Bank Holding Company Act. Extending credit is one of those activities, and so is brokering loans.

The rule's own examples include a mortgage broker, a retailer that issues its own credit card to consumers, an auto dealership that leases vehicles for longer than 90 days, a check-cashing business and a business that regularly wires money for consumers. Consumer finance companies, payday and installment lenders, auto finance companies and non-bank mortgage lenders all extend credit, so they fall in the same group. Banks and credit unions answer to their own banking regulators instead.

The US has no equivalent of India's NBFC category. If you also lend in India, the RBI rules are separate; see our VAPT guide for NBFCs.

What section 314.4(d)(2) requires

Section 314.4(d)(1) asks every covered firm to regularly test or otherwise monitor how well its key safeguards work, including the controls that detect actual and attempted attacks. Section 314.4(d)(2) then says what that means for information systems. Absent effective continuous monitoring, you must carry out:

What counts as a penetration test

The rule defines it in section 314.2: a test in which assessors try to get around or defeat the security features of an information system, from outside or inside your systems. An automated scan that lists missing patches is a vulnerability assessment, not a penetration test. You need both, on different schedules.

The rule does not require an outside firm. An independent tester does give your Qualified Individual results that did not come from the people who built the systems, and those results go into the annual report described below.

Continuous monitoring as the alternative

The testing schedule applies only if you lack effective continuous monitoring or other systems that detect, on an ongoing basis, changes in your information systems that may create vulnerabilities. The rule does not name a product or method. If you choose this route, be ready to show that your monitoring covers your systems and catches new weaknesses as they appear, since that is the test the rule sets.

The 5,000-consumer exemption

Section 314.6 exempts financial institutions that maintain customer information concerning fewer than 5,000 consumers from four requirements: the written risk assessment in 314.4(b)(1), the testing schedule in 314.4(d)(2), the written incident response plan in 314.4(h) and the annual report in 314.4(i). The count is consumers whose information you hold, not only today's active borrowers.

A small lender still has to meet the rest of the rule. That includes a Qualified Individual, access controls, encryption, multi-factor authentication, staff training, service provider oversight, the general duty in 314.4(d)(1) to regularly test or monitor key controls, and the FTC breach notice.

What a lender's penetration test should cover

The rule ties scope to your risk assessment, so the test should follow where borrower data actually lives and moves. For most lenders that means:

How testing feeds the annual report and breach notice

Section 314.4(i) requires your Qualified Individual to report in writing, at least once a year, to your board or a senior officer. The report must cover material matters, and the rule lists results of testing among them. Plan the penetration test so its findings, and the fixes, are ready before that report is due.

Since 13 May 2024, section 314.4(j) also requires you to notify the FTC within 30 days of discovering a notification event that involves the information of at least 500 consumers. A notification event is the unauthorized acquisition of unencrypted customer information. Gaps that testing finds and you fix are gaps that cannot lead to one.

A simple yearly testing calendar

For a lender above the 5,000-consumer line and not relying on continuous monitoring, a workable year looks like this:

Where we can help

We run penetration tests and vulnerability assessments scoped to a lender's risk assessment, write the report in a form your Qualified Individual can use, and retest the fixes. See our VAPT services. Source: FTC Safeguards Rule, 16 CFR Part 314, sections 314.1, 314.2, 314.4 and 314.6, as published on eCFR in November 2026. This is general information, not legal advice; check your state licensing regulator for any additional rules.