GLBA compliance and requirements, made workable for financial businesses of every size.

What it is

What is GLBA and what is it used for?

The Gramm-Leach-Bliley Act is a US federal law enacted in 1999. Title V of the Act deals with consumer financial privacy. Its first part tells financial institutions to protect the privacy of consumers' personal financial information: explain their sharing practices in a privacy notice and let consumers opt out before nonpublic personal information goes to unaffiliated third parties. It also requires safeguards for that information. A second part prohibits pretexting: obtaining a financial institution's customer information by false pretences.

In practice GLBA is delivered through regulations. The Consumer Financial Protection Bureau's Regulation P sets the privacy notice and opt-out rules for most institutions, while the Federal Trade Commission keeps a parallel Privacy Rule for certain motor vehicle dealers. The FTC's Safeguards Rule sets the security standard for the non-bank financial institutions under its jurisdiction, and banks follow the Interagency Guidelines Establishing Information Security Standards issued by the OCC, the Federal Reserve Board and the FDIC.

Current law. The Safeguards Rule was substantially revised in October 2021, and its main new provisions, including the Qualified Individual, the written risk assessment, encryption and multi-factor authentication, applied from 9 June 2023. A 2023 amendment added a duty to notify the FTC of certain security events, effective from 13 May 2024. Your legal advisers confirm which rules and regulator apply to your institution.

Who it is for

Who needs GLBA compliance?

GLBA reaches well beyond banks. The FTC treats a business as a financial institution when it engages in activities that are financial in nature, and its own examples include mortgage lenders and brokers, payday lenders, finance companies, account servicers, check cashers, wire transferors, collection agencies, credit counsellors, tax preparation firms and investment advisers. Organisations come to Sterling for GLBA from four starting points:

• A customer or partner bank asks for evidence. A lender, card programme or platform partner sends a security questionnaire referencing the Safeguards Rule, and a policy document alone will not answer it.
• A tender or investor due diligence raises it. Buyers of fintech, servicing or collections capacity want to see the Qualified Individual, the risk assessment and the last board report before they sign.
• A regulator's expectations have moved. The 2021 and 2023 amendments made the safeguards specific; older programmes often have gaps in testing, encryption and notification.
• A group company or provider inherits the obligation. Offshore teams, contact centres and IT providers handling US customer information must show controls that fit the institution's programme.

Requirements

What are the main GLBA requirements?

GLBA obligations fall into two families: the privacy rules on notices and sharing, and the safeguards rules on security. The summary below follows Regulation P and the FTC Safeguards Rule at title level; your programme is checked against the current text of the rule that applies to you, with your legal advisers.

• Privacy notices: give an initial privacy notice, an annual notice unless the rule's exception applies, and a revised notice when practices change.
• Opt-out rights: tell consumers how to opt out of sharing with nonaffiliated third parties and honour their choice.
• Limits on disclosure and reuse: restrict what nonaffiliated third parties receive, how they may reuse or redisclose it and the sharing of account numbers for marketing.
• Qualified Individual: designate one person to oversee, implement and enforce the information security programme.
• Written risk assessment: identify foreseeable risks to customer information and assess the safeguards in place.
• Safeguards: design and implement controls for the identified risks, including access controls, encryption and multi-factor authentication.
• Monitoring and testing: regularly test or monitor whether the safeguards work.
• People and service providers: train staff to deliver the programme and oversee the service providers that handle customer information.
• Incident response and reporting: keep a written incident response plan, have the Qualified Individual report in writing to the board and adjust the programme on the results.
• Notification to the FTC: report a notification event affecting at least 500 consumers as soon as possible and no later than 30 days after discovery.

Compliance process

How do you become GLBA compliant?

There is no audit that ends in a GLBA certificate. Compliance is a programme you run and can demonstrate on request to the regulator that oversees you, to partner banks and to customers. Sterling supports the build and the evidence; questions of legal interpretation stay with your advisers.

1. 01
   Confirm how GLBA applies to you.Map the activities that make you a financial institution, the regulator and rule set that apply, your consumers and customers, and whether the 5,000-consumer exception is relevant.
2. 02
   Gap analysis: review current practice against the rules.The gap analysis compares notices, sharing, contracts and each safeguards element with what exists today, and agrees actions, owners and dates.
3. 03
   Build the written programme.Designate the Qualified Individual, complete the risk assessment, implement the safeguards and align privacy notices with actual data flows.
4. 04
   Test, train and report to the board.Run the testing and monitoring, train staff, review service providers, rehearse the incident response plan and deliver the Qualified Individual's written report.
5. 05
   Operate and demonstrate.Keep the programme current, notify the FTC when a notification event occurs, and answer examinations, partner reviews and questionnaires with evidence.

Check the route before you sign. A "GLBA certified" badge is not issued by any US regulator, so ask what a provider actually delivers and who reviews it. Where a partner accepts SOC 2 reports or ISO/IEC 27001 certificates as supporting evidence, verify the service auditor or the accredited certification body directly; accreditation recognition runs through the Global ACI arrangement for certification bodies.

Cost

How much does GLBA compliance cost?

A small tax practice and a multi-state lender face the same rules at very different scale. The price follows the data you hold and the controls already working; a Sterling proposal shows each component and one all-inclusive proposal.

Timeline

How long does GLBA compliance take?

A first programme usually takes three to six months as an estimate, depending on how much already exists, how quickly technical safeguards can be put in place and how many providers need review. The programme then runs continuously, with testing, training, provider oversight and board reporting on a yearly rhythm.

Your engagement

What your GLBA engagement includes

Your engagement follows Sterling OS™. Choose the support level that suits your team: Design™, where we guide and your people build, or Drive™, where we manage the build with them. These are alternatives, not stages. After the programme is live, Sustain™ keeps the annual cycle running, and Automate™ is Effivity, where the programme lives from the first workshop. Sterling does not certify, attest or validate GLBA compliance, and no one can issue a GLBA certificate.

• Applicability, gap analysis and plan

  Which rules apply, what is missing and who acts by when, agreed before work starts.

• Written information security programme

  Qualified Individual designation, risk assessment, policies and safeguards, built with your IT and operations owners.

• Effivity ISO & GRC software

  Your GLBA programme runs in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Privacy notices and provider oversight

  Notices checked against real data flows, and service provider assessments and contract clauses, reviewed with your legal advisers.

• Internal audit and board report

  An internal audit of the programme and support for the Qualified Individual's written report to the board.

Compliance decisions rest with the CFPB, the FTC, the federal banking regulators and the courts; no certificate is issued.

Often combined with

Standards organisations pair with GLBA

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
• Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
• BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
• CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.