FTC Safeguards Rule for CPA firms: what it means for client records and referrals

Short answer: does the Safeguards Rule stop a CPA firm from making introductions?

No, provided the introduction moves nothing out of your files. The FTC Safeguards Rule governs how a covered firm protects the customer information it holds. It does not stop a client from licensing its own operating records. What it does settle is the status of the material in your portal: returns, workpapers, payroll registers and bank statements are customer information you safeguard on the client's behalf, not an asset your firm can sell, license or share.

That gives a clean dividing line. Your firm's files stay inside your security program. The client's own systems, such as its CRM, help desk, project tools and shared drives, belong to the client, and only the client can decide to license them. A referral connects the client's owner with SourceX; the company then works with SourceX directly, and nothing passes through your firm. The referral guide for accountants covers which clients tend to fit.

What does the FTC Safeguards Rule actually require?

The rule applies to financial institutions under the FTC's jurisdiction, and that group is wider than banks. The FTC's guide, FTC Safeguards Rule: What Your Business Needs to Know, lists tax preparation firms among the non-bank businesses that fall within the rule's definition of a financial institution. If your firm prepares returns, assume the rule covers the customer information connected to that work, and confirm with counsel how it treats your audit, advisory and client accounting services.

The rule text at 16 CFR Part 314 implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley Act and requires a covered firm to maintain a written information security program, the document often called a WISP. Elements the rule spells out include:

• a designated Qualified Individual who oversees and enforces the program;
• encryption of customer information in transit over external networks and at rest;
• a written incident response plan.

The FTC's guidance also describes a notification duty: covered institutions must notify the FTC no later than 30 days after discovering a security event involving the information of at least 500 consumers. An introduction that never touches client files cannot cause that kind of event, which is one more reason to keep introductions file-free.

Whose records are they? The custody test

Before any conversation about data licensing, sort each record into one of three piles: what you hold for clients, what clients hold themselves, and what your firm generates about its own work.

The last row surprises some firm owners. A CPA practice produces years of structured work product, yet almost all of it describes clients' affairs, so it fails the rights test before anyone asks whether it is valuable.

How does the rule apply in common introduction situations?

Most of these questions surface at year-end planning meetings, during extension season or at a CAS monthly close. Here is how to think through the usual ones.

A safe introduction, step by step

Only three things ever move: the company's name, a contact, and the fit facts the owner tells you in conversation.

1. Ask the owner whether they would like to hear about licensing their company's operating records, and note the answer in your client file.
2. Screen fit from the conversation, never from workpapers. SourceX looks for US companies with 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to license the material and an owner or executive able to sponsor it. The company fit checker asks for no contact details, so the owner can run it alone.
3. Share your referral link, which takes the owner to sourcex.si/apply with your code attached, or submit the company through the referral form once the owner agrees.
4. Step out of the way. SourceX qualifies the company, the company builds its own data inventory, and price, terms and redaction rules are agreed with the company before any work begins; how it works walks through each stage.

No buyer receives anything without an executed agreement and the company's authorization, and your firm never sits in the data path.

Disclosure and consent good practice

Handle the introduction like any recommendation made outside an engagement: documented, voluntary and transparent.

• Get the owner's permission before you mention the company to anyone, and keep a dated note of it.
• Tell the owner in writing if your firm could receive a referral reward, before they decide anything.
• Keep introduction emails to names, titles and contact details; never attach a client document.
• Use your normal firm email and client channels so your program's monitoring still covers the exchange.

Questions to bring to counsel or your Qualified Individual

• Which of our service lines bring us within the Safeguards Rule, and does our written program say so?
• Does our engagement letter or firm policy address recommending outside services to clients?
• Do state accountancy rules on referral fees or commissions apply to us, and do they differ for attest clients?
• Where should client consents and referral disclosures be filed so they survive staff turnover?

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

How referral rewards work for CPA firms

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, up to $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee; no reward is guaranteed. The reward comes out of SourceX's fee, so it never reduces what your client receives.

Whether your firm may accept a reward at all is a separate professional-ethics question under the AICPA Code and your state board's rules. Start with whether a CPA can accept a referral fee, and settle it before you register.

Next step

Choose one business client you know runs on a dozen or more systems and raise the question at your next planning meeting. Then register as a partner so the introduction is credited to you, or send the owner straight to sourcex.si/apply with your referral link.