FTC Safeguards training for tax preparers

If your firm prepares tax returns, there’s a good chance the FTC Safeguards Rule applies to you, even if you’ve never thought of yourself as a “financial institution.” The Rule’s definition is broad enough to capture most tax preparation businesses, and it comes with a specific staff training expectation.

What the Rule actually requires

The FTC Safeguards Rule, at 16 CFR 314.4(e), requires covered financial institutions to train personnel to implement their written information security program. This is a confirmed, general requirement. What we recommend you verify directly on ftc.gov, since the Rule has been amended in recent years, is the current exact paragraph lettering before you cite a specific subsection to a client or examiner.

What this looks like in a small tax practice

Training doesn’t need to be an enterprise security course. For a small or mid-size firm, it typically needs to cover:

• Phishing recognition, since tax-season phishing volume spikes every year around filing deadlines
• IRS and W-2 impersonation scams specifically, since these target payroll data and client tax documents directly
• Safe handling of client documents, including not emailing unencrypted tax documents and using only your approved client portal
• A reporting habit, so staff flag a suspicious email or an accidental data exposure immediately instead of hoping it resolves itself

A seasonal staffing problem worth planning for

Many tax firms bring on seasonal preparers and support staff for a few months a year, often with little to no prior security training. Waiting until an incident happens to train them is the expensive way to learn this lesson. Building a 30-day onboarding training requirement into your seasonal hiring process closes this gap before it opens.

Training is one safeguard, not the whole program

The Safeguards Rule requires a full written information security program: a designated qualified individual, a risk assessment, access controls, encryption, incident response planning, and more. Training supports the “train personnel” element of that program. It is not a substitute for the rest of it, and your written program should be reviewed with a qualified compliance advisor.

Our US Spotlight: IRS/W-2 and Tax-Season Scams module and our dedicated FTC Safeguards Rule Essentials module are built specifically for this. See our CPA & tax firms page for the full picture.