Regulatory glossary for professional firms

Also Safeguards Rule; 16 CFR Part 314

The Federal Trade Commission’s rule under the Gramm-Leach-Bliley Act (GLBA) for safeguarding customer information. Among those it covers are tax preparation firms and investment advisors not required to register with the SEC. Each must keep a written information security program with safeguards fitting its size and complexity, the nature and scope of its activities and the sensitivity of the information.

A business significantly engaged in a financial activity described in the Bank Holding Company Act. The Safeguards Rule names one outright: “An accountant or other tax preparation service that is in the business of completing income tax returns”. ABA v. FTC kept the practice of law outside the FTC’s GLBA authority but never names the Safeguards Rule; ask counsel.

A continuing relationship in which the firm provides a financial product or service to a consumer, an individual who uses it primarily for personal, family or household purposes. The rule’s own examples include a consumer who becomes the firm’s client for tax preparation. That client is a customer, so records holding their nonpublic personal information are customer information.

Personally identifiable financial information: anything a consumer gives the firm to obtain a financial product or service, or that the firm obtains about them in providing it. Even the fact that someone is or has been the firm’s customer counts. Publicly available information is left out, unless it appears on a list of consumers derived from nonpublic financial information.

Any record, in paper, electronic or other form, containing nonpublic personal information about a customer of a financial institution. It counts when handled or maintained by or on behalf of the firm or its affiliates. For an individual tax client, that reaches the return, the source documents, the engagement correspondence and the portal copies.

Also WISP; information security program

The written information security program the Safeguards Rule requires: the safeguards a firm uses to handle customer information. It must be written “in one or more readily accessible parts” and include the elements in 16 CFR 314.4. IRS Publication 1345 points tax practices to Publication 5708, “Creating a Written Information Security Plan for Your Tax & Accounting Practice”.

The individual the firm designates to oversee, implement and enforce its information security program. That person may work for the firm, an affiliate or a service provider. With an affiliate or provider, the firm keeps responsibility, names a senior staff member to direct and oversee that person, and requires it to keep a program meeting the rule.

Any person or entity that receives, maintains, processes or may otherwise access customer information by directly serving a firm covered by the Safeguards Rule. The firm must take reasonable steps to choose and keep providers that can maintain appropriate safeguards, and require those safeguards by contract. It assesses each provider periodically, on its risk and whether its safeguards remain adequate.

Also Safeguards Rule small-institution exception

Four paragraphs of the Safeguards Rule do not apply to a firm holding customer information on fewer than 5,000 consumers. They are 314.4(b)(1), (d)(2), (h) and (i): the written risk assessment, the fixed testing schedule, the written incident response plan and the annual written report. The risk assessment and the testing duty themselves remain.

Acquisition of unencrypted customer information without the authorization of the individual to which the information pertains. Data counts as unencrypted if someone unauthorized accessed the key; unauthorized access is presumed to be acquisition unless reliable evidence shows otherwise. At 500 or more consumers, the firm must notify the FTC as soon as possible, no later than 30 days after discovery.

A notification event counts as discovered on the first day any employee, officer or other agent of the firm knows of it, other than the person committing the breach. The FTC’s 30-day clock runs from that day, not from the partners’ briefing. The SEC’s clock starts on becoming aware, Wisconsin’s on learning of the acquisition, the IRS’s on confirmation.

A written plan to promptly respond to and recover from any security event materially affecting the confidentiality, integrity or availability of customer information the firm controls. A security event means unauthorized access to, or disruption or misuse of, a system, its data or paper customer records. It must cover seven listed areas, and is not required below 5,000 consumers.

Under IRS Publication 1345, an event that can result in unauthorized disclosure, misuse, modification or destruction of taxpayer information. Authorized IRS e-file Providers of individual income tax returns must report it to the IRS as soon as possible, by the next business day after confirmation. That clock runs from confirmation, not discovery; a later IRS revision exists, so check it.

Last name and first name or initial, linked to a Social Security, driver’s license, state ID or financial account number, account code or password, DNA profile or unique biometric data. Publicly available, encrypted, redacted or unreadable elements do not count. Unauthorized acquisition can require notice within a reasonable time, at most 45 days after the firm learns of it.

Wisconsin’s breach law excludes a firm “subject to, and in compliance with,” the Gramm-Leach-Bliley Act’s privacy and security requirements, if it has a breach policy in effect. It also excludes that firm’s contractors with such a policy, and HIPAA covered entities complying with 45 CFR part 164. A CPA firm may fall outside the statute this way; ask your counsel.

Also 31 CFR Part 10

The Treasury rules for practice before the IRS, published as 31 CFR Part 10. Practice includes preparing and filing documents, corresponding with the IRS and representing a client at conferences, hearings and meetings. Its duties bind practitioners: the attorneys, CPAs, enrolled agents and others listed in section 10.3(a) to (f).

Also OPR

The IRS office with general responsibility for “matters related to practitioner conduct” under Circular 230. It also has “exclusive responsibility for discipline, including disciplinary proceedings and sanctions.” For your firm, that means any Circular 230 discipline of your practitioners runs through OPR.

A practitioner must exercise due diligence in preparing, approving and filing returns and other IRS papers. It also covers checking that what they tell Treasury, and clients about IRS matters, is correct. Relying on another person’s work is presumed diligent if the practitioner took reasonable care engaging, supervising, training and evaluating them, subject to sections 10.34 and 10.37.

A practitioner must have the competence needed to practice before the IRS. Competent practice “requires the appropriate level of knowledge, skill, thoroughness, and preparation necessary for the matter”. Ways to get there include consulting experts in the area or studying the relevant law.

Also 31 CFR 10.36

Whoever has principal authority over a firm’s tax practice must take reasonable steps to ensure the firm has adequate procedures for everyone to comply with Circular 230. If the firm names no one, the IRS may identify who is responsible. Discipline needs willfulness, recklessness or gross incompetence, and a pattern or practice of noncompliance at the firm.

Also Provider

“A firm accepted to participate in IRS e-file.” Providers of individual income tax returns must report a security incident to the IRS as soon as possible, no later than the next business day after confirming it. Under the section 7216 regulations, every Authorized IRS e-file Provider is a tax return preparer.

Also ERO

“An Authorized IRS e-file Provider that originates the electronic submission of returns to the IRS.” Without the client’s consent, an ERO may pass return information to a Transmitter or Intermediate Service Provider located in the United States, for e-filing. An ERO-only Provider reports a security incident by contacting its local stakeholder liaison.

Also EFIN

“An identification number assigned by the IRS to accepted applicants for participation in IRS e-file.” A dropped EFIN is one “no longer valid due to inactivity or other administrative action.”

Also Safeguarding Taxpayer Data

Safeguarding Taxpayer Data, A Guide for Your Business: an IRS publication on safeguarding taxpayer data, “including how to create a data security plan”. Publication 1345 says it covers security standards and best practice guidelines, with links to NIST publications. For the written plan itself, the IRS points tax and accounting practices to Publication 5708.

Also Microsoft 365 tenant

Your firm’s own Microsoft 365. Microsoft keeps each tenant’s content logically separate through Microsoft Entra permission controls. Microsoft stores Microsoft 365 Copilot prompts and responses at rest in your tenant’s geography, but the model that answers them runs outside your tenant.

The sign-in and access settings for your firm’s Microsoft 365. Your administrator can use Microsoft Entra ID security groups to limit who may use an outside AI provider, such as Anthropic, in Microsoft 365 Copilot.

Microsoft’s family of compliance services for Microsoft 365, including Microsoft Purview Data Loss Prevention, Information Protection and eDiscovery. Microsoft stores each Microsoft 365 Copilot prompt and response in the user’s Exchange Online mailbox, so an administrator can search them and set retention policies for them in Purview.

Labels that mark confidential files. A label can also encrypt what it marks, using Microsoft Purview Information Protection. For content encrypted that way, Microsoft 365 Copilot honors the usage rights granted to the user.

A Microsoft 365 feature that, once turned on, makes a Microsoft support engineer get your firm’s explicit approval before reaching your content; unanswered requests expire. Microsoft says it covers Microsoft 365 Copilot interactions; where the model runs is outside it. It comes with Microsoft 365 or Office 365 E5, or the Microsoft Purview Suite for Business Premium add-on.

Also content of interactions

What Microsoft calls the “content of interactions”: a user’s prompt to Microsoft 365 Copilot and Copilot’s response. Microsoft stores them in the user’s Exchange Online mailbox, and commits to store them at rest in the United States for U.S. tenants. That answers where they are stored, not where the model runs.

Also processing location

The separate question from storage: where the AI model does its work on a prompt. Microsoft 365 Copilot’s requests go to a model outside your tenant, routed to the closest data centers in the region or, at busy times, other regions. For U.S. tenants, U.S.-only processing is expected by the end of 2026, not committed.

Also storage location

Where your data is stored at rest, a separate question from where the model runs. OpenAI’s business plans offer the two as separate opt-in settings (ChatGPT Enterprise and Edu: new workspaces only); a consumer account has neither. Anthropic documents a U.S.-only processing setting for its API, where the default is global routing, and neither control for Team and Enterprise.

Microsoft’s commitment, for its EU Data Boundary services, to store and process customer data inside the EU and EFTA. For EU customers, Microsoft 365 Copilot is one, but Anthropic models in it are currently excluded. For a U.S. tenant, Microsoft commits to where Microsoft 365 Copilot prompts and responses are stored at rest, not where they are processed.

A company Microsoft hires for part of the work, contractually limited to using your data for it. Microsoft’s terms let it transfer data to “the United States or any other country in which Microsoft or its Subprocessors operate.” Anthropic is one, on by default for most commercial tenants outside the EU, EFTA and UK; your administrator can turn it off.