WISP for payday lenders and finance companies
Payday lenders and finance companies need a WISP when the business is covered by the FTC Safeguards Rule category payday lender / finance company. The practical coverage trigger is that the firm extends consumer credit, short-term loans, installment loans, or other finance-company credit products. Customer information appears in loan applications, bank-account verification, ACH authorization, underwriting files, payment-processing systems, collection workflows, store workstations, and online borrower portals. High-risk data often includes bank routing/account details and income records.
Key facts
- Payday lenders and finance companies should evaluate coverage under the FTC Safeguards Rule and document the factual trigger: extends consumer credit, short-term loans, installment loans, or other finance-company credit products.
- The data map should be vertical-specific: Customer information appears in loan applications, bank-account verification, ACH authorization, underwriting files, payment-processing systems, collection workflows, store workstations, and online borrower portals. High-risk data often includes bank routing/account details and income records.
- A storefront lender may cross 5,000 consumers through repeat borrowers and historical records. Under 16 CFR 314.6, sub-threshold firms still need a security program and safeguards.
Key takeaways
- Payday lenders and finance companies should evaluate coverage under the FTC Safeguards Rule and document the factual trigger: extends consumer credit, short-term loans, installment loans, or other finance-company credit products.
- The data map should be vertical-specific: Customer information appears in loan applications, bank-account verification, ACH authorization, underwriting files, payment-processing systems, collection workflows, store workstations, and online borrower portals. High-risk data often includes bank routing/account details and income records.
- A storefront lender may cross 5,000 consumers through repeat borrowers and historical records. Under 16 CFR 314.6, sub-threshold firms still need a security program and safeguards.
- Our loans are small-dollar and short-term. Loan size does not remove the customer-information risk; the rule turns on financial activity and the information maintained.
Why payday lenders and finance companies are covered
Payday lenders and finance companies are covered when their business activity fits payday lender / finance company. FTC guidance lists payday lenders and finance companies among Safeguards Rule financial institutions.
The coverage test is factual. For this vertical, Policywright treats the trigger as: extends consumer credit, short-term loans, installment loans, or other finance-company credit products. The sources block below is limited to primary-source or regulator materials so the page does not drift into unsourced compliance folklore.
The page does not invent a coverage theory beyond the cited category and factual trigger.
Where customer information lives
Customer information appears in loan applications, bank-account verification, ACH authorization, underwriting files, payment-processing systems, collection workflows, store workstations, and online borrower portals. High-risk data often includes bank routing/account details and income records.
That data-flow map changes the WISP. A tax preparer worries about portals and e-file records; a collection agency worries about placement files, dialers, and dispute queues; an auto dealer worries about the credit application, F&I office, DMS, and lender portals.
A useful written program should name the systems, roles, vendors, access paths, retention points, and evidence records that fit the trade.
Common objection
Our loans are small-dollar and short-term. Loan size does not remove the customer-information risk; the rule turns on financial activity and the information maintained.
Policywright handles that objection by writing the factual basis into the packet rather than hiding it. If coverage is unclear, the firm should preserve the question for counsel instead of turning a WISP into an unsupported legal conclusion.
Under-5,000-consumer analysis
A storefront lender may cross 5,000 consumers through repeat borrowers and historical records. Under 16 CFR 314.6, sub-threshold firms still need a security program and safeguards.
16 CFR 314.6 exempts smaller covered firms only from 314.4(b)(1), (d)(2), (h), and (i). It does not remove the written-program duty or the need to protect customer information with reasonable administrative, technical, and physical safeguards.
A serious small-firm packet should document the count assumption and keep the fuller controls where they are operationally useful.
| Question | Vertical-specific answer | Source |
|---|---|---|
| Coverage trigger | extends consumer credit, short-term loans, installment loans, or other finance-company credit products | FTC Safeguards Rule business guidance |
| Customer data flow | Customer information appears in loan applications, bank-account verification, ACH authorization, underwriting files, payment-processing systems, collection workflows, store workstations, and online borrower portals. High-risk data often includes bank routing/account details and income records. | Document in WISP data inventory |
| Common objection | Our loans are small-dollar and short-term. Loan size does not remove the customer-information risk; the rule turns on financial activity and the information maintained. | FTC Safeguards Rule business guidance |
| Small-firm exception | A storefront lender may cross 5,000 consumers through repeat borrowers and historical records. Under 16 CFR 314.6, sub-threshold firms still need a security program and safeguards. | 16 CFR 314.6 |
FAQ
Is this legal advice?
No. Policywright is a configurable template product, not a law firm and not legal advice. A qualified lawyer should review state-law reliance or breach-notification decisions.
Does a small firm still need a written plan?
Yes. The Safeguards Rule requires a written information security program for covered financial institutions, and IRS guidance tells paid tax preparers to maintain a written data security plan.
What if a control is not in place yet?
A serious WISP should not pretend. It should identify the gap, assign an owner, set a target date, and preserve a dated remediation record.
What makes payday lenders and finance companies different from tax preparers?
The data flow and objection pattern are different. Payday lenders and finance companies need a WISP that follows Customer information appears in loan applications, bank-account verification, ACH authorization, underwriting files, payment-processing systems, collection workflows, store workstations, and online borrower portals. High-risk data often includes bank routing/account details and income records.
Does Policywright cover related non-Safeguards obligations?
No separate related obligation is claimed on this page. Policywright is focused on the Safeguards Rule policy packet and does not replace counsel.
Sources
Build a WISP for payday lenders and finance companies.
Answer plain questions and receive a source-cited policy packet tailored to the firm's systems, vendors, and gaps.
Build my plan