Under 5,000 Clients? Four Safeguards Rule Duties You Do Not Have, and the Ones You Still Do

The Safeguards Rule contains an exception for firms holding customer information on fewer than five thousand consumers, and it removes four specific obligations. Three are documents and the fourth is a testing schedule. Every control that actually protects the data survives, as does the duty to update your program when you deploy something new.

This is information, not legal advice.

What does 314.6 actually say?

It is one sentence. 16 CFR 314.6 says that four provisions, 314.4(b)(1), (d)(2), (h) and (i), "do not apply to financial institutions" that hold customer information on "fewer than five thousand consumers."

That is the whole exception. There is no application, no filing and no certification. If you are under the line, those four subsections simply do not apply to you, and a compliance vendor quoting you for all four is quoting you for work the rule does not ask of you.

Which four duties fall away?

The written risk assessment, the penetration testing and vulnerability assessment cadence, the written incident response plan, and the annual report. They are the four heaviest pieces of paperwork in 314.4, and none of them is a safeguard on the data itself.

• 314.4(b)(1), the written risk assessment. You still have to think about risk, because the rest of the program is built on it. You do not have to produce the formal written assessment in the form the subsection prescribes.
• 314.4(d)(2), the penetration testing and vulnerability assessment cadence.
• 314.4(h), the written incident response plan.
• 314.4(i), the annual report.

For a ten person practice that is a meaningful reduction, and it is worth confirming you qualify before you sign anything.

Each exemption is also narrower than its label. Paragraph (b)(1) is the sentence requiring that the risk assessment "shall be written" and contain stated criteria and mitigation requirements; the duty in 314.4(b) to base the program on a risk assessment, and the periodic reassessments in (b)(2), are not on the 314.6 list. Paragraph (d)(2) is the testing schedule: effective continuous monitoring, or else annual penetration testing plus vulnerability assessments at least every six months and after material changes; (d)(1), the duty to regularly test or otherwise monitor your key controls, still applies.

What does the exception not remove?

Every control that touches the data. Encryption, multi factor authentication and the service provider duties all sit in 314.4 outside the four exempted subsections, so they apply to a two partner firm exactly as they apply to a national one.

The encryption requirement is worth reading closely. 314.4(c)(3) requires you to encrypt all customer information you hold or transmit, "both in transit over external networks and at rest", with "effective alternative compensating controls reviewed and approved by your Qualified Individual" where encryption is infeasible. Note that the compensating control route only works if your Qualified Individual reviews and approves it, so record that approval in writing.

Before that approval comes a determination: the paragraph allows a compensating control only to the extent you determine encryption is infeasible, and the control must be effective. A firm that simply does not encrypt something has not used the provision at all.

The right way to describe 314.6 to a partner: it is an exception about documents, not an exception about security.

Does the exception cover the duty to update your program?

No, and this is the one that catches firms adding AI tools. 314.4(g) requires the program to be adjusted for "any material changes to your operations or business arrangements", and (g) does not appear in the 314.6 list.

So a four person firm that starts routing client data through a model owes the same adjustment a four hundred person firm owes. What the exception spares you is the surrounding paperwork, the formal written risk assessment and the annual report. It does not spare you the update itself, and your WISP almost certainly does not mention AI yet. 314.4(c)(7), "Adopt procedures for change management", is also outside the exception, which means the small firm still needs a procedure for how a new tool gets approved before it touches client data.

Change management is a paragraph every AI deployment engages, because a model version, a prompt, a vendor or a data flow can each change without anyone filing a ticket. A practical test of whether the procedure works: can your firm say which version of a tool processed a client's data in March? If not, it will struggle to show a procedure rather than a subscription. In a production agent, that traceability comes from a release gate and an audit trail of every agent action.

How do you count to five thousand?

The text counts consumers, not clients, not engagements and not staff. That distinction is where firms get the answer wrong in their own favor.

A practice with 300 business clients can feel comfortably under the line and not be. If your engagements put you in contact with individual returns, W-2 data, K-1 recipients or beneficial owners, those are individuals whose customer information you maintain, and they are countable. The arithmetic runs on people, and a modest book of business entities can carry several thousand people inside it.

Treat that as a reading of the text rather than a settled answer, because the rule does not supply a counting method and reasonable advisers differ on the edges. The practical posture: if your own count lands anywhere near five thousand, plan as though you are over it. The exception is worth money only when you are clearly inside it, and a position you would struggle to defend is not worth the four documents it saves.

The rule gives no counting method, but it does define consumer. Under 314.2(b)(1), a consumer is "an individual who obtains or has obtained a financial product or service from you", or that individual's legal representative, where the product or service is to be used primarily for personal, family or household purposes. Two things follow. "Has obtained" reaches former clients, and 314.1(b) applies the rule to all customer information in your possession, whether or not it concerns someone with whom you have a customer relationship, so on that wording the files you keep for former clients go into the count. And the personal, family or household test describes a different population from your client list, which is exactly where a mix of individual and entity engagements needs a written answer rather than an assumption. Read strictly, an employee whose W-2 you see only through a business client did not obtain a service from you, so counting them is the cautious choice above, not one the definition requires.

What happens if your count crosses five thousand?

You pick up the four obligations 314.6 was sparing you, including a written incident response plan, and nothing in the rule tells you it has happened. That is why relying on the exception should rest on a dated count, redone every year and after any acquisition or purchase of a book of business.

A firm that crosses the line without noticing is worse off than one that never relied on 314.6: it is now subject to four paragraphs it has not been meeting, with no grace period for catching up.

Is a model API a service provider at this size?

On the text, yes, and firm size has nothing to do with it. 314.2 defines a service provider as any person or entity that "receives, maintains, processes, or otherwise is permitted access to customer information" through services it provides directly to a financial institution the rule covers.

"Processes" is listed separately from "maintains", which disposes of the argument that a vendor retaining nothing is not a service provider. Taking data in, computing on it and returning a result is processing whether or not a copy survives.

Say plainly that this is a reading of the definition and not a ruling. We are not aware of an FTC action or court decision applying 314.2 to a model API. The cost asymmetry is what should decide it for a small firm: the cautious reading costs you a diligence file, and the convenient reading costs you a finding if a regulator disagrees.

What does vendor oversight require at this size?

The three steps in 314.4(f), none of which 314.6 exempts: take reasonable steps to select and retain capable providers, require safeguards by contract, and periodically assess each one on its risk and safeguards. On the cautious reading of 314.2, they cover any model vendor processing customer information, at any firm size.

How far those steps reach for a large model provider you cannot audit is genuinely unsettled. Nothing in 314.4 names AI models, and it does not say what reasonable selection, or an effective compensating control, looks like when a vendor will not describe its internals. We set out the diligence questions to put to an AI vendor separately.

Does the 30 day notification clock apply to small firms?

Yes. 314.4(j) requires notification to the FTC within 30 days of discovery where the event involves at least 500 consumers, and (j) is not in the 314.6 list.

Hold the two numbers next to each other, because they are not the same number. You can sit comfortably below 5,000 consumers for the exception and still blow through 500 consumers on a single incident. A firm that read 314.6 as a general exemption from the rule will discover the difference at the worst possible moment, with a 30 day clock that started at discovery rather than at the point the picture became clear.

Is 314.6 an exception to Section 7216 as well?

No. 314.6 is an exception inside the FTC Safeguards Rule and it has no effect on the tax disclosure rules, which come from a different statute and a different agency.

On that regime, correct a common error while you are here: 26 CFR 301.7216-3(a)(1) provides that a preparer may disclose or use tax return information "as the taxpayer directs", provided the preparer obtains "a written consent from the taxpayer" in the form that section requires. Section 7216 is not a prohibition that cannot be consented away, and guidance telling you otherwise has misread the regulation. The form and timing requirements for that consent live in the regulation text, including the rule at (b)(1) that there is no retroactive consent, so read the section and have counsel check it against the current version rather than relying on a template. We go through 7216 and AI tools in more detail, including what is still open.

What to do if you are near the line

Four steps, in order.

• Count consumers, not clients, and write down the method you used and the date. A documented count you can defend is the asset here, not the number itself.
• If you are clearly under, record which four subsections you are relying on 314.6 for. Do not throw away the documents you already have.
• If you are anywhere near, build the program as though you are over. The incremental cost is lower than the cost of being wrong.
• Either way, do the change management procedure and the vendor inventory, because neither is exempted and both are what an AI deployment lands on first.

Where Gaper fits

Gaper builds and deploys custom AI agents for accounting firms into your own cloud environment, which keeps the data path inside infrastructure you already describe in your security program and puts its logs, credentials and hosting region under your control. We work as an implementation partner rather than a software vendor, so you own the agents and the configuration outright. General enquiries go to hello@gaper.io.

Owning the agents changes control, not legal status. Gaper, and any model provider the agent calls, can still receive or process customer information, so both belong in your 314.4(f) vendor file like any other service provider. Gaper is the AI-native implementation partner that deploys supervised AI agents you own. More on how an AI-native implementation partner works.

What this means for your firm

Count your consumers before you buy anything, because the four documents 314.6 removes are the expensive ones and plenty of small firms pay for them without needing to. Do not read the exception as permission to skip encryption, vendor diligence or the 30 day notification clock, none of which it touches. If you are adding an AI tool, 314.4(g) and the change management procedure apply at your size, so the update is owed now rather than at some future threshold.

Book a free AI assessment

Thirty minutes, no commitment. We map one workflow, make the build or buy call, and scope the smallest thing worth shipping.