Car Dealers and Repair Shops Are Now Regulated Like Banks: The FTC Rule Driving It

Here is a fact that surprises almost every independent auto dealer and shop owner who hears it: if your business arranges financing for customers, the federal government now expects you to protect customer data much the way a bank does. You are treated, for security purposes, as a financial institution. It sounds far-fetched, a car lot regulated like a bank, but it is real, it is in effect right now, and the great majority of small dealers and shops have no idea it applies to them. In 2026, that lack of awareness is becoming genuinely risky, because enforcement has stepped up.

The rule behind this is the FTC Safeguards Rule, the same federal data-security regulation we have written about for accounting firms. Rather than repeat that full breakdown, this article focuses on what it means specifically for auto dealers and repair shops, why you are covered, and what to do about it. One important note up front, and I mean it: this is general education, not legal or compliance advice. Compliance obligations are specific and consequential, so the right move is to work with a qualified professional for your situation. My goal is to make sure you know this applies to you, so you can act before a problem finds you. Let me explain.

Why a car dealer is a "financial institution"

The logic catches people off guard, but it is straightforward once you see it. The Safeguards Rule, which comes from a federal law about financial privacy, applies to "financial institutions." Most dealers hear that and think, "that's not me, I sell cars." But the FTC defines a financial institution by what it does, not what it calls itself, and one of the activities that qualifies is extending or arranging credit. When your dealership helps a customer finance or lease a vehicle, you are engaging in exactly that kind of financial activity, which places you squarely under the rule.

So if your dealership arranges financing or leasing, and most do, the FTC considers you a financial institution, and the Safeguards Rule applies to you. This is not a gray area or a maybe. It has been made clear, and the core requirements have been mandatory since 2023. The reason so few small dealers realize it is simply that nobody told them, and the phrase "financial institution" does not sound like it means a car lot. But it does.

And it is not only franchise dealers. Independent used-car dealers, buy-here-pay-here lots, and even repair shops that offer or arrange financing plans for customers can fall under this, because it is the financing activity that triggers coverage, not the size or type of the business. If money is being borrowed or credit arranged through your business, this rule is very likely in play, which is worth confirming for your specific situation.

The goldmine of data you are holding

Understanding why this rule targets dealers makes the whole thing click. Think about what a customer hands over to finance a vehicle. A credit application is a treasure trove of exactly the sensitive information criminals want most: Social Security numbers, dates of birth, driver's license details, income information, employment details, bank account information, and more. Every financing deal you do means collecting and storing this deeply sensitive personal and financial data, often for many customers, sometimes going back years.

That makes an auto dealership a rich target, because a breach could expose the kind of information that enables identity theft and fraud on a large scale. It is the same reason protecting customer payment and financial information matters so much, which we cover in protecting customer payment data. The federal rule exists precisely because dealers hold this goldmine, and the data deserves real protection, both because the law requires it and because your customers trusted you with their most sensitive details.

What the rule actually requires

The Safeguards Rule lays out a set of specific security requirements. Rather than reproduce the full explanation here, we cover the core obligations in depth in our guide to the FTC Safeguards Rule for accounting firms, and the same framework applies to dealers. In brief, the rule requires you to build and maintain a written information security program, designate a qualified individual to oversee it, conduct a risk assessment, and put specific protections in place, including multi-factor authentication for anyone accessing customer information, encryption of sensitive data, access controls, employee training, monitoring, and more, along with breach-notification obligations.

Notice that these are, at their core, the standard set of sound security practices, applied to the customer financial data your dealership holds and backed by a formal, documented program. Two elements tend to get the most attention in dealer compliance and enforcement: multi-factor authentication, which has become a primary focus of audits, and the written information security program itself, which is the documented proof that you are doing what the rule requires. Documentation is central here, because the rule expects you not just to be secure but to demonstrate it.

There is some relief for the smallest operations, as the rule eases certain requirements for businesses maintaining information on fewer than a threshold number of consumers, but the core protections still apply. Lighter does not mean exempt.

Why this matters urgently in 2026

Here is the part that turns this from "interesting" into "act now." The prescriptive requirements have been mandatory since 2023, and the breach-notification piece since 2024, which means the compliance clock has already been running for a while. More importantly, 2026 has brought a clear increase in enforcement, with the FTC pursuing more actions against auto dealers specifically. The period of quiet, where the rule existed but few were being held to it, is ending.

For a dealer or shop, that means the risk is no longer theoretical. Non-compliance can carry penalties, and a breach of all that sensitive financing data would be devastating on its own, in cost, in liability, and in lost customer trust. The dealers who get ahead of this now will be compliant and protected. Those who continue assuming it does not apply to them are increasingly exposed on two fronts at once: the regulators and the criminals. Given that the requirements are essentially good security practices anyway, getting compliant is not wasted effort; it is real protection that also keeps you on the right side of the law.

What to do now

If you arrange financing, treat this as a priority, not a someday. Start with an honest risk assessment of what customer data you hold and where you are exposed. Put the core protections in place: multi-factor authentication on access to customer information, encryption, strong access controls, and the rest of the fundamentals. Build and document your written information security program and designate someone to own it. And work with people who understand both security and compliance, alongside a qualified compliance professional or attorney, so you are not interpreting a federal rule on your own. This is exactly the kind of work a security partner handles, protecting the data and building the documented program that compliance requires.

How we think about it

Helping businesses meet compliance obligations while genuinely protecting their customers is central to how we work at Red Door Shield, alongside your compliance advisors, through a simple framework we call KIT: Keep, Inspect, Trust. Keep what is valuable secure, which for a dealer means the sensitive financing data and the multi-factor authentication, encryption, and access controls the rule requires. Inspect what is coming in, with monitoring that catches threats to that data and supports the ongoing review the rule expects. And trust through validation, the documented, provable security program that turns "we're compliant" into something you can actually demonstrate. We handle the security and documentation side so that, with your compliance advisor on the legal specifics, your dealership is both genuinely protected and genuinely compliant.

What ready looks like

Picture your dealership meeting this rule with confidence: customer financing data encrypted and access protected, a written security program in place and documented, multi-factor authentication enforced, and someone owning it all. If the FTC's heightened scrutiny reaches your industry, you are ready. If a customer asks how their credit application is protected, you have a real answer. And the goldmine of sensitive data you hold is genuinely guarded, not a breach waiting to happen. You handled it ahead of the enforcement wave rather than scrambling behind it.

That is what ready looks like for a dealer or shop under this rule. Not hoping it does not apply to you, but knowing it does, and having handled it properly, protecting your customers, your business, and your standing with regulators all at once.

Most independent dealers and shops have no idea they are regulated like banks, and in 2026, that gap is closing fast as enforcement ramps up. If your business arranges financing, the FTC Safeguards Rule applies to you, and the sensitive data you hold deserves real protection regardless. If you want help understanding where your dealership stands and protecting customer data to the standard the rule requires, our free Business Security Assessment is the place to start, and pairing it with a qualified compliance advisor gives you the complete picture. It is a conversation worth having today.