US bookkeepers: separate Safeguards Rule scope and file evidence

Handling bank statements is not, by itself, a determination that a US bookkeeping business falls under the FTC Safeguards Rule. Build a record of the actual services, data and workflow for the person responsible for assessing the business. Keep that legal-scope decision separate from the practical protection of each PDF, CSV and destination copy.

Establish the activity and jurisdiction before claiming coverage

The FTC’s business guide ties coverage to the business’s financial activities and FTC jurisdiction, rather than its job title. Tax-preparation services are among its examples. Do not infer that every bookkeeper is covered, or exempt, solely because a statement contains financial information.

Record whether the engagement is bookkeeping, tax preparation or another actual service; who receives it; the relevant consumer/customer relationship; and who will resolve applicability. Keep the responsible reviewer’s conclusion and supporting source/version with the engagement. An unresolved scope question is not a completed compliance assessment. The rule text, sections 314.1 and 314.2, supplies the definitions that the business must apply to its own circumstances.

Keep the 5,000 and 500 thresholds separate

Under section 314.6, maintaining customer information concerning fewer than 5,000 consumers exempts a covered institution from specified provisions, not the entire rule. This is not a headcount of files, bank rows or client companies.

A different provision, section 314.4(j), concerns a defined notification event involving at least 500 consumers. The required FTC notice is as soon as possible, within 30 days of discovery. The definition includes unauthorised acquisition of unencrypted customer information; a compromised encryption key and the rule’s presumption about unauthorised access matter. A screenshot, suspected incident or rough client count alone cannot decide that test.

Escalate a possible incident promptly through the existing incident process. Preserve its discovery timeline and evidence for the responsible incident/legal team. The FTC test is not a universal deadline for state notices, client contracts, every security event or every regulator. Do not wait for a guessed 500-person count before escalating internally, and do not treat “under 5,000” as a reason to ignore it.

Map the actual bank-document path

Use an engagement-specific working register alongside the business’s security program. This register identifies questions for review; filling it in does not certify a compliant program.

1. Source and intake. Identify the authorised sender, agreed intake channel, client/account alias and statement coverage. A filename is not evidence that a document belongs to the right client. Preserve the original and the actual received revision.
2. Processing and derived files. List the PDF, extracted CSV, reviewed working copy and any spreadsheet or support attachment separately. Record the device and chosen output location; a local conversion does not establish whether that location synchronises elsewhere.
3. Recipients and providers. Record each actual destination, its intended recipient/purpose and the evidence of access approval. Include storage, bookkeeping uploads and support channels that the job really uses. An app’s marketing description does not supply the engagement’s authorisation.
4. Retention questions. Record the applicable policy, contractual/legal retention question and responsible owner before disposing of anything. Do not use one generic seven-year period or empty a recovery folder just to make the register look complete. Preserve any legal hold and unresolved evidence.
5. Review and handoff. Keep the reviewed file identity, source of each control observation, reviewer and open questions. Request a new review when the destination, file revision or scope changes. Do not retain an earlier approval label after altering its inputs.

For operational detail, use the bookkeeper intake and handoff guide, OneDrive folder-status guide or known download/recent-file observations. Those pages answer narrower file questions; they do not determine this business’s statutory coverage.

Test the conclusion you are actually entitled to record

The review-case data describe fictional situations, not findings about a customer or a legal assessment of a particular business:

These examples deliberately stop short of legal clearance. The responsible review needs the business facts and applicable requirements, not a converter choice or a completed template alone.

LocalExtract parses and performs OCR on the device, processes one PDF at a time and exports date,description,amount CSV. Conversion does not require uploading that PDF. Account services, updates and periodic Pro verification need a network; saved files can still be copied by the user’s storage and sharing workflow. LocalExtract does not determine Safeguards Rule coverage, supply a written security program or certify compliance.

Updated October 17, 2026: corrected blanket coverage, small-institution exception and notification-threshold claims; replaced universal retention and incident deadlines with scope-specific evidence questions. Official FTC/eCFR sources checked on that date; the eCFR page displayed Title 16 current through October 15, 2026.