Yes, if the firm is covered by the FTC Safeguards Rule as investment advisory company and credit counseling service, it needs a written security program for customer information. Citation: 16 CFR Part 314 and 16 CFR 314.2(h)(2)(xii).
Primary source: 16 CFR 314.2(h)(2)(xii)
Does a credit counselor or financial advisor need a WISP?
Details
provides credit counseling, debt-management advice, financial planning, or investment advisory services to consumers. Information lives in intake questionnaires, budgets, creditor lists, account statements, planning software, CRM notes, document portals, payment-plan records, and advisor email. The WISP should separate advice records from any payment or debt-management data handled by vendors. Many counseling practices are below 5,000 consumers, but multi-location or high-volume programs may not be. The exception does not remove safeguards or written-program duties.
Primary source: 16 CFR 314.2(h)(2)(xii).
FAQ
Does a credit counselor or financial advisor need a WISP?
Yes, if the firm is covered by the FTC Safeguards Rule as investment advisory company and credit counseling service, it needs a written security program for customer information. Citation: 16 CFR Part 314 and 16 CFR 314.2(h)(2)(xii).
What is the data-flow issue for a credit counselor or financial advisor?
Information lives in intake questionnaires, budgets, creditor lists, account statements, planning software, CRM notes, document portals, payment-plan records, and advisor email. The WISP should separate advice records from any payment or debt-management data handled by vendors.
Is this legal advice?
No. It is source-cited educational content for a template product, not legal advice.