WISP for credit counselors and financial advisors
Credit counselors and financial advisors need a WISP when the business is covered by the FTC Safeguards Rule category investment advisory company and credit counseling service. The practical coverage trigger is that the firm provides credit counseling, debt-management advice, financial planning, or investment advisory services to consumers. Information lives in intake questionnaires, budgets, creditor lists, account statements, planning software, CRM notes, document portals, payment-plan records, and advisor email. The WISP should separate advice records from any payment or debt-management data handled by vendors.
Key facts
- Credit counselors and financial advisors should evaluate coverage under the FTC Safeguards Rule and document the factual trigger: provides credit counseling, debt-management advice, financial planning, or investment advisory services to consumers.
- The data map should be vertical-specific: Information lives in intake questionnaires, budgets, creditor lists, account statements, planning software, CRM notes, document portals, payment-plan records, and advisor email. The WISP should separate advice records from any payment or debt-management data handled by vendors.
- Many counseling practices are below 5,000 consumers, but multi-location or high-volume programs may not be. The exception does not remove safeguards or written-program duties.
Key takeaways
- Credit counselors and financial advisors should evaluate coverage under the FTC Safeguards Rule and document the factual trigger: provides credit counseling, debt-management advice, financial planning, or investment advisory services to consumers.
- The data map should be vertical-specific: Information lives in intake questionnaires, budgets, creditor lists, account statements, planning software, CRM notes, document portals, payment-plan records, and advisor email. The WISP should separate advice records from any payment or debt-management data handled by vendors.
- Many counseling practices are below 5,000 consumers, but multi-location or high-volume programs may not be. The exception does not remove safeguards or written-program duties.
- We give advice, not loans. The rule names advisory and credit-counseling activity because the business still receives detailed consumer financial information.
Why credit counselors and financial advisors are covered
Credit counselors and financial advisors are covered when their business activity fits investment advisory company and credit counseling service. 16 CFR 314.2(h)(2)(xii) names investment advisory companies and credit counseling services as financial institutions.
The coverage test is factual. For this vertical, Policywright treats the trigger as: provides credit counseling, debt-management advice, financial planning, or investment advisory services to consumers. The sources block below is limited to primary-source or regulator materials so the page does not drift into unsourced compliance folklore.
The page does not invent a coverage theory beyond the cited category and factual trigger.
Where customer information lives
Information lives in intake questionnaires, budgets, creditor lists, account statements, planning software, CRM notes, document portals, payment-plan records, and advisor email. The WISP should separate advice records from any payment or debt-management data handled by vendors.
That data-flow map changes the WISP. A tax preparer worries about portals and e-file records; a collection agency worries about placement files, dialers, and dispute queues; an auto dealer worries about the credit application, F&I office, DMS, and lender portals.
A useful written program should name the systems, roles, vendors, access paths, retention points, and evidence records that fit the trade.
Common objection
We give advice, not loans. The rule names advisory and credit-counseling activity because the business still receives detailed consumer financial information.
Policywright handles that objection by writing the factual basis into the packet rather than hiding it. If coverage is unclear, the firm should preserve the question for counsel instead of turning a WISP into an unsupported legal conclusion.
Under-5,000-consumer analysis
Many counseling practices are below 5,000 consumers, but multi-location or high-volume programs may not be. The exception does not remove safeguards or written-program duties.
16 CFR 314.6 exempts smaller covered firms only from 314.4(b)(1), (d)(2), (h), and (i). It does not remove the written-program duty or the need to protect customer information with reasonable administrative, technical, and physical safeguards.
A serious small-firm packet should document the count assumption and keep the fuller controls where they are operationally useful.
| Question | Vertical-specific answer | Source |
|---|---|---|
| Coverage trigger | provides credit counseling, debt-management advice, financial planning, or investment advisory services to consumers | 16 CFR 314.2(h)(2)(xii) |
| Customer data flow | Information lives in intake questionnaires, budgets, creditor lists, account statements, planning software, CRM notes, document portals, payment-plan records, and advisor email. The WISP should separate advice records from any payment or debt-management data handled by vendors. | Document in WISP data inventory |
| Common objection | We give advice, not loans. The rule names advisory and credit-counseling activity because the business still receives detailed consumer financial information. | 16 CFR 314.2(h)(2)(xii) |
| Small-firm exception | Many counseling practices are below 5,000 consumers, but multi-location or high-volume programs may not be. The exception does not remove safeguards or written-program duties. | 16 CFR 314.6 |
FAQ
Is this legal advice?
No. Policywright is a configurable template product, not a law firm and not legal advice. A qualified lawyer should review state-law reliance or breach-notification decisions.
Does a small firm still need a written plan?
Yes. The Safeguards Rule requires a written information security program for covered financial institutions, and IRS guidance tells paid tax preparers to maintain a written data security plan.
What if a control is not in place yet?
A serious WISP should not pretend. It should identify the gap, assign an owner, set a target date, and preserve a dated remediation record.
What makes credit counselors and financial advisors different from tax preparers?
The data flow and objection pattern are different. Credit counselors and financial advisors need a WISP that follows Information lives in intake questionnaires, budgets, creditor lists, account statements, planning software, CRM notes, document portals, payment-plan records, and advisor email. The WISP should separate advice records from any payment or debt-management data handled by vendors.
Does Policywright cover related non-Safeguards obligations?
No separate related obligation is claimed on this page. Policywright is focused on the Safeguards Rule policy packet and does not replace counsel.
Sources
Build a WISP for credit counselors and financial advisors.
Answer plain questions and receive a source-cited policy packet tailored to the firm's systems, vendors, and gaps.
Build my plan