16 CFR §314.6 — Exceptions (FTC GLBA Safeguards Rule)

glba-safeguards-16cfr-314-6

16 CFR §314.6 establishes a small-institution exception for the written-risk-assessment-contents, continuous-monitoring-or-pen-test, incident-response plan, and annual-board-reporting requirements where customer information is maintained on fewer than 5,000 consumers.

Get this register: .xlsx .csv More bundles →

source:
  type: regulation
  id: glba-safeguards-16cfr-314.6
  authority: 16 CFR §314.6 — Exceptions (FTC GLBA Safeguards Rule)
  description: |
    16 CFR §314.6 establishes a small-institution exception for the
    written-risk-assessment-contents, continuous-monitoring-or-pen-test,
    incident-response plan, and annual-board-reporting requirements
    where customer information is maintained on fewer than 5,000
    consumers.
obligations:
  - id: glba-safeguards-16cfr-314.6-small-institution-exception-applicability
    canonical_id: glba-safeguards-16cfr-314.6-small-institution-exception-applicability
    section: 16 CFR §314.6 — Small-institution exception applicability determination
    description: |
      [LENDER] shall determine whether it maintains customer information
      concerning fewer than five thousand consumers. Where [LENDER] is
      above that threshold, §§ 314.4(b)(1), (d)(2), (h), and (i) apply
      in full and [LENDER] may not rely on the small-institution
      exception. Where [LENDER] is at or below that threshold, [LENDER]
      may rely on the exception but shall document the consumer count
      underlying that determination and reassess applicability as its
      customer base changes.
    type: do
    audit_question: Has [LENDER] documented the count of consumers whose customer information it maintains, the source/methodology of that count, the date of determination, and the conclusion as to whether the §314.6 small-institution exception applies?
    program_review: Does the program account for the §314.6 small-institution exception — determining whether [LENDER] maintains customer information on fewer than 5,000 consumers, documenting the consumer count and methodology, and reassessing as the customer base changes (so §§314.4(b)(1),(d)(2),(h),(i) are correctly applied or excepted)?
    file_review: Confirm the documented consumer count, its source/methodology, the determination date, and the applicability conclusion; spot-check the count basis.
    judgment: false
    feeds: []
    workflow_phase: governance
    owner_role: compliance_officer
    secondary_owner_role: information_security_officer
    cadence: annual
    consequence: ''
    tags:
      - round-b
      - regulator-direct
      - glba
      - safeguards-rule
      - exception
      - applicability
      - small-institution
      - promoted
    primary_source:
      tier: 1
      authority: 16 CFR §314.6
      source_class: ftc-safeguards-rule
      source_url: https://www.law.cornell.edu/cfr/text/16/314.6
      snapshot_id: 606c7f5a2fe08fcd
      fetched_at: '2026-05-24T00:44:14Z'
      content_hash: sha256:0c2912762c965870518b8306526793185d1a82c5142760044d344a8cb6be29b2
      paragraph_quote: Section 314.4(b)(1) , (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.
      drafter_attestation: |
        Copied verbatim from snapshot 606c7f5a2fe08fcd (content.txt) at
        2026-05-23T01:34Z. Substring is the full §314.6 operative
        small-institution exception sentence.
    promoted_at: '2026-05-24T01:27:09+00:00'
    promoted_from: glba-safeguards-16cfr-314.6-roundb-v1.yaml
  - id: glba-safeguards-16cfr-314.6-non-excepted-elements-still-required
    canonical_id: glba-safeguards-16cfr-314.6-non-excepted-elements-still-required
    section: 16 CFR §314.6 — Non-excepted §314.4 elements remain required for small institutions
    description: |
      The §314.6 exception is narrow: only §§ 314.4(b)(1), (d)(2), (h),
      and (i) are excepted for small institutions. Where [LENDER]
      qualifies as a small institution under §314.6, [LENDER] remains
      subject to the remaining §314.4 elements — including (a) Qualified
      Individual designation, (b) risk-assessment basis, (c) safeguards
      (1)-(8) (access controls, asset management, encryption, secure
      development, MFA, secure disposal, change management, monitoring
      and logging), (e) personnel training and qualified security staff,
      (f) service-provider oversight, (g) program evaluation and
      adjustment, and (j) FTC notification of notification events
      involving 500+ consumers.
    type: do
    audit_question: Even where [LENDER] qualifies for the §314.6 small-institution exception, can [LENDER] demonstrate continued compliance with the non-excepted §314.4 elements — (a), (b) (apart from (b)(1) written-contents), (c)(1)-(8), (e), (f), (g), and (j)?
    program_review: Does the program account for the narrowness of the §314.6 exception — ensuring that even a qualifying small institution remains compliant with the non-excepted §314.4 elements ((a), (b) apart from (b)(1) written-contents, (c)(1)-(8), (e), (f), (g), (j))?
    file_review: For a small-institution [LENDER], confirm continued compliance with the non-excepted §314.4 elements despite the exception.
    judgment: false
    feeds: []
    workflow_phase: governance
    owner_role: compliance_officer
    secondary_owner_role: information_security_officer
    cadence: annual
    consequence: ''
    tags:
      - round-b
      - regulator-direct
      - glba
      - safeguards-rule
      - exception
      - applicability
      - small-institution
      - promoted
    primary_source:
      tier: 1
      authority: 16 CFR §314.6
      source_class: ftc-safeguards-rule
      source_url: https://www.law.cornell.edu/cfr/text/16/314.6
      snapshot_id: 606c7f5a2fe08fcd
      fetched_at: '2026-05-24T00:44:14Z'
      content_hash: sha256:0c2912762c965870518b8306526793185d1a82c5142760044d344a8cb6be29b2
      paragraph_quote: Section 314.4(b)(1) , (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.
      drafter_attestation: |
        Copied verbatim from snapshot 606c7f5a2fe08fcd (content.txt) at
        2026-05-23T01:34Z. The §314.6 enumeration of excepted paragraphs
        defines the scope by negative implication; the residual obligation
        (everything not in the listed exception) is reasoned in description
        from the verbatim text of §314.6 and the structure of §314.4.
    promoted_at: '2026-05-24T01:27:09+00:00'
    promoted_from: glba-safeguards-16cfr-314.6-roundb-v1.yaml
_promotion_history:
  - promoted_at: '2026-05-24T01:27:09+00:00'
    candidate_path: obligations\_remediation\_round_b_drafts\glba-safeguards-16cfr-314.6-roundb-v1.yaml
    candidates_promoted: 2
    candidates_skipped_existing: 0

Verbatim regulatory text (2)

Verbatim provisions from 16 CFR §314.6 — Exceptions (FTC GLBA Safeguards Rule) — each quote is a verified substring of the regulator-published source snapshot, not retyped. Quoted for reference; this is not legal advice. The operational layer (P&P updates, prompts) lives in the regulation update kits.

16 CFR §314.6 — Small-institution exception applicability determination

Section 314.4(b)(1) , (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.

Source: 16 CFR §314.6 · source URL · snapshot 606c7f5a2fe08fcd

16 CFR §314.6 — Non-excepted §314.4 elements remain required for small institutions

Section 314.4(b)(1) , (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.

Source: 16 CFR §314.6 · source URL · snapshot 606c7f5a2fe08fcd