GLBA compliance for crypto and fintech firms handling customer data

a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}

GLBA compliance is not limited to traditional banks. A crypto or fintech business may need a GLBA program when it is significantly engaged in financial activities for consumers and handles customer information. For most covered firms, the work falls into two connected areas: explaining information-sharing practices through privacy notices and protecting customer information through a written safeguards program.

The FTC Safeguards Rule now makes incident planning more time-sensitive. Its breach notification requirement took effect on May 13, 2024, and requires covered financial institutions to notify the FTC of certain events involving at least 500 consumers. For crypto firms, the threshold question is activity-based rather than label-based: what financial product or service is being offered, what customer data is collected, and which regulator has authority?

What GLBA compliance means

The Gramm-Leach-Bliley Act, often shortened to GLBA, is a U.S. financial privacy and data security law. According to FTC guidance, it applies to financial institutions that offer consumers financial products or services such as loans, financial advice, investment-related services, insurance or money movement. Covered firms must tell customers how they share information and must safeguard sensitive data.

For a digital asset business, GLBA compliance usually does not depend on whether the asset is described as crypto, a token, a stablecoin or a digital commodity. It depends on the business activity and the data relationship. A company that only publishes open-source code may have a different GLBA profile from a centralized platform that collects KYC information, maintains customer accounts, provides custody, arranges consumer credit, offers investment advice or transfers funds.

That distinction matters because GLBA is only one layer of a broader compliance stack. A crypto company may also face state money transmitter rules, securities or commodities regulation, sanctions controls, state privacy laws and state breach notice laws. GLBA does not replace those regimes, but it can affect how customer information is collected, stored, shared and reported after an incident.

When crypto and fintech firms should assess GLBA coverage

The FTC Safeguards Rule applies to financial institutions under FTC jurisdiction. Current 16 CFR Part 314 describes covered financial institutions broadly and gives examples such as account servicers, wire transferors, check cashers, credit counselors, certain investment advisers, finance companies and entities acting as finders. Because the list is not exhaustive, a crypto or fintech firm should map its actual services against the rule instead of relying only on its industry category.

A practical review starts with three questions: whether the company offers a consumer financial product or service, whether it has a continuing customer relationship, and whether it handles nonpublic personal information. If the answer is uncertain, the point is not to assume GLBA definitely applies. The firm should document its coverage analysis and update it when products, data flows or customer relationships change.

Privacy notice obligations and information sharing

The privacy side of GLBA focuses on transparency and limits on sharing nonpublic personal information with nonaffiliated third parties. Regulation P and related agency rules generally require covered financial institutions to provide privacy notices describing the categories of information collected, the categories of information disclosed, the categories of affiliates and nonaffiliated third parties receiving information, and the customer’s opt-out rights where applicable.

Initial privacy notices are especially important in crypto onboarding flows because many products collect sensitive information before an account is funded. A platform may collect government identification, address information, bank account details, device identifiers, wallet addresses, source-of-funds information and transaction history. Some blockchain data may be visible on a public ledger, but a company’s internal link between a person, account, wallet address and transaction profile can still create sensitive customer information.

Annual notices are not required in every circumstance. CFPB materials on Regulation P describe an annual notice exception where a financial institution shares nonpublic personal information only under specified exceptions and has not changed the policies and practices disclosed in its most recent notice. Firms that rely on an exception should treat it as a controlled compliance decision, not as a reason to ignore notice governance. A new data-sharing partnership, analytics use case or affiliate transfer may change the analysis.

Safeguards Rule controls crypto teams should prioritize

The FTC Safeguards Rule requires a comprehensive written information security program with administrative, technical and physical safeguards appropriate to the firm’s size, complexity, activities and customer information. The rule is not a general cybersecurity statement. It identifies specific program elements that can be tested in an audit, enforcement investigation or breach review.

Covered firms must designate a qualified individual to oversee and enforce the program. That person may work for the company, an affiliate or a service provider, but the financial institution remains responsible for compliance. For crypto firms, this point is significant because security work is often divided among internal engineers, cloud vendors, wallet infrastructure providers, custodians and compliance tooling vendors.

The rule also requires a risk assessment that identifies reasonably foreseeable internal and external risks and evaluates whether existing safeguards are sufficient. In crypto, that assessment should be detailed enough to cover wallet administration, private key management, API access, customer support workflows, withdrawal controls, SIM-swap exposure, employee access to KYC systems, blockchain analytics integrations and cloud storage. A generic enterprise IT risk register will rarely be enough for a digital asset business.

Other Safeguards Rule elements include access controls, data and system inventory, encryption of customer information at rest and in transit where feasible, secure development practices, multi-factor authentication unless an approved equivalent is used, secure disposal, change management, activity logging, monitoring, testing, staff training, service provider oversight, incident response and written reporting to the board or equivalent governing body. The rule also includes a limited exception for financial institutions that maintain customer information concerning fewer than 5,000 consumers, but that exception does not remove every safeguard obligation.

The FTC breach notification rule changed incident response planning

The most concrete recent GLBA change is the FTC Safeguards Rule breach notification requirement. Section 314.4(j) became effective on May 13, 2024. Covered financial institutions must notify the FTC as soon as possible and no later than 30 days after discovery if a notification event involves the information of at least 500 consumers. See also: Blockchain Technology.

A notification event means the acquisition of unencrypted customer information without authorization. Under the rule, encrypted customer information can be treated as unencrypted if the encryption key was accessed by an unauthorized person. The rule also presumes unauthorized acquisition from unauthorized access unless the firm has reliable evidence showing that acquisition did not occur and could not reasonably have occurred.

This changes how crypto firms should structure incident response. A company cannot wait until every forensic question is fully resolved if the 30-day clock has started. Response plans should identify who can determine discovery, how evidence is preserved, who evaluates the 500-consumer threshold, who prepares the FTC report, and how state breach laws and customer notices are handled in parallel. The FTC reporting form also indicates that reports may become public, so accuracy and consistency matter.

Crypto-specific data risks under GLBA

Digital asset firms often hold data sets that become more revealing when combined. A wallet address on its own may be public. A wallet address linked to a verified identity, IP history, trading record, bank transfer, device fingerprint and compliance alert can become a detailed financial profile. GLBA compliance should therefore focus on linkability, not only on whether a data element appears sensitive in isolation.

Service provider risk is another recurring issue. Exchanges and wallets frequently rely on identity verification vendors, chain analytics vendors, cloud hosting, customer support software, marketing tools, payment processors and custody infrastructure. The Safeguards Rule requires reasonable steps to select capable service providers, contracts requiring appropriate safeguards, and periodic reassessment based on risk. For crypto firms, vendor due diligence should address data fields shared, retention periods, breach notice commitments, subcontractors, key access and audit rights.

Product changes can also alter the GLBA profile. Adding fiat on-ramps, lending, staking-like rewards, account recovery, card programs or third-party analytics may expand the amount and sensitivity of customer information. Compliance teams should connect product approval to privacy notices, data maps, risk assessments and vendor reviews before launch, not after an incident.

A practical GLBA compliance checklist

• Document whether each product line is a consumer financial product or service and which regulator is likely to enforce the relevant GLBA duties.
• Maintain a current data inventory covering KYC data, account records, wallet mappings, device data, support tickets, transaction data and vendor transfers.
• Review privacy notices for accuracy, including affiliate sharing, nonaffiliated third-party sharing and opt-out rights.
• Designate a qualified individual and define board or senior officer reporting.
• Create a written risk assessment that reflects crypto-specific systems and abuse patterns.
• Use least-privilege access controls and multi-factor authentication for systems containing customer information.
• Encrypt customer information at rest and in transit where feasible, and document any approved compensating controls.
• Test controls through continuous monitoring or scheduled penetration testing and vulnerability assessments where required.
• Put vendor safeguards into contracts and reassess higher-risk vendors periodically.
• Update the incident response plan for the 30-day FTC notification requirement and for state breach notice coordination.

For more coverage of financial privacy, digital asset oversight and compliance trends, see the Regulation and Compliance section.

Frequently asked questions

Does GLBA automatically apply to every crypto company?

No. GLBA coverage is activity-based. A company should analyze whether it is significantly engaged in financial activities, whether it serves consumers, whether it has customer relationships and whether it handles nonpublic personal information. A pure software or protocol project may have a different profile from a custodial exchange or lending platform.

Can wallet addresses be customer information?

A public wallet address is not always customer information by itself. The risk increases when a firm links that address to a verified person, account, transaction history, device data or compliance file. GLBA programs should evaluate the combined data set and the possibility of reidentification.

Is GLBA compliance the same as cybersecurity compliance?

No. Cybersecurity controls are a major part of the Safeguards Rule, but GLBA compliance also includes privacy notices, limits on information sharing, opt-out rights in certain cases, vendor oversight, retention decisions, board reporting and breach notification duties.

Do small firms have fewer obligations?

The Safeguards Rule includes a limited exception for financial institutions that maintain customer information concerning fewer than 5,000 consumers. However, that exception applies only to specified elements and does not eliminate the need for reasonable safeguards or privacy compliance where GLBA otherwise applies.

Does FTC notification replace customer breach notices?

No. The FTC Safeguards Rule creates a federal notification obligation to the FTC for qualifying events. Customer notices, state regulator notices and obligations under other financial, securities, commodities or state privacy laws may still apply depending on the facts.

Source basis: FTC GLBA and Safeguards Rule guidance, current eCFR 16 CFR Part 314, and CFPB Regulation P materials available as of the publication date.