Yes, if the firm is covered by the FTC Safeguards Rule as finder, it needs a written security program for customer information. Citation: 16 CFR Part 314 and 16 CFR 314.2(h)(2)(xiii).
Primary source: 16 CFR 314.2(h)(2)(xiii)
Does a finder need a WISP?
Details
brings together buyers and sellers for transactions the parties negotiate and consummate. Finder data may live in lead forms, marketplace profiles, referral databases, eligibility screens, CRM records, email introductions, and analytics exports. The WISP should distinguish ordinary marketing leads from consumer financial information collected to make a financial-service match. Lead-generation volume can make the 5,000-consumer threshold arrive quickly. If below it, the firm still needs the core written security program and safeguards.
Primary source: 16 CFR 314.2(h)(2)(xiii).
FAQ
Does a finder need a WISP?
Yes, if the firm is covered by the FTC Safeguards Rule as finder, it needs a written security program for customer information. Citation: 16 CFR Part 314 and 16 CFR 314.2(h)(2)(xiii).
What is the data-flow issue for a finder?
Finder data may live in lead forms, marketplace profiles, referral databases, eligibility screens, CRM records, email introductions, and analytics exports. The WISP should distinguish ordinary marketing leads from consumer financial information collected to make a financial-service match.
Is this legal advice?
No. It is source-cited educational content for a template product, not legal advice.