Yes, if the firm is covered by the FTC Safeguards Rule as account servicer, it needs a written security program for customer information. Citation: 16 CFR Part 314 and FTC Safeguards Rule business guidance.
Primary source: FTC Safeguards Rule business guidance
Does an account servicer need a WISP?
Details
services consumer credit accounts, payment accounts, or loan portfolios for another entity. Servicing data lives in boarding files, account platforms, payment systems, call-center tools, correspondence queues, dispute workflows, vendor portals, and investor or client reports. The WISP should identify data received from the owner and data generated by servicing activity. Servicers frequently exceed the threshold because one client file can contain thousands of accounts. If a niche servicer is below it, the exception remains narrow.
Primary source: FTC Safeguards Rule business guidance.
FAQ
Does an account servicer need a WISP?
Yes, if the firm is covered by the FTC Safeguards Rule as account servicer, it needs a written security program for customer information. Citation: 16 CFR Part 314 and FTC Safeguards Rule business guidance.
What is the data-flow issue for an account servicer?
Servicing data lives in boarding files, account platforms, payment systems, call-center tools, correspondence queues, dispute workflows, vendor portals, and investor or client reports. The WISP should identify data received from the owner and data generated by servicing activity.
Is this legal advice?
No. It is source-cited educational content for a template product, not legal advice.