Must a non-bank financial firm report a data breach to the FTC?

Financial services firm

Financial institutions under FTC jurisdiction, after unauthorized acquisition of unencrypted information of at least 500 consumers.

Yes, a notification event must be reported to the FTC.

Maintain an information security program and notify the FTC of qualifying events through its online form.

not_in_register

1. Maintain the written security program
2. Assess the event against the 500-consumer threshold
3. Notify the FTC
4. Document the response

As soon as possible and no later than 30 days after discovery.

• 16 CFR 314.4(j)

sha256 f36e21f4ef283db712c3e9cf55a6f406cf4cdd2cf47a719e274ad1e03545efd8 · read 2026-10-15 · Source: NovaCopilot

• When must a listed company disclose a cyber incident?
• What must a financial entity report after a major ICT incident?
• What is needed before offering a crypto-asset to the public in the EU?
• Do I need a licence to provide crypto-asset services in the EU?
• What is required to issue an asset-referenced token in the EU?

• agent:eu:business:aml-customer-due-diligence (business_agent)
• agent:eu:business:aml-suspicious-transaction-report (business_agent)
• agent:eu:business:dora-ict-incident (business_agent)
• agent:eu:business:mica-asset-referenced-token (business_agent)
• agent:eu:business:mica-casp-authorisation (business_agent)
• agent:eu:business:mica-e-money-token (business_agent)
• agent:eu:business:mica-white-paper (business_agent)
• agent:us:business:sec-cyber-incident (business_agent)
• case_kit:us:ftc:equifax-2019 (case_kit)