Yes, if the firm is covered by the FTC Safeguards Rule as payday lender / finance company, it needs a written security program for customer information. Citation: 16 CFR Part 314 and FTC Safeguards Rule business guidance.
Primary source: FTC Safeguards Rule business guidance
Does a payday lender or finance company need a WISP?
Details
extends consumer credit, short-term loans, installment loans, or other finance-company credit products. Customer information appears in loan applications, bank-account verification, ACH authorization, underwriting files, payment-processing systems, collection workflows, store workstations, and online borrower portals. High-risk data often includes bank routing/account details and income records. A storefront lender may cross 5,000 consumers through repeat borrowers and historical records. Under 16 CFR 314.6, sub-threshold firms still need a security program and safeguards.
Primary source: FTC Safeguards Rule business guidance.
FAQ
Does a payday lender or finance company need a WISP?
Yes, if the firm is covered by the FTC Safeguards Rule as payday lender / finance company, it needs a written security program for customer information. Citation: 16 CFR Part 314 and FTC Safeguards Rule business guidance.
What is the data-flow issue for a payday lender or finance company?
Customer information appears in loan applications, bank-account verification, ACH authorization, underwriting files, payment-processing systems, collection workflows, store workstations, and online borrower portals. High-risk data often includes bank routing/account details and income records.
Is this legal advice?
No. It is source-cited educational content for a template product, not legal advice.