Short answer: Yes, almost certainly. If your dealership extends financing, arranges leases, or facilitates any kind of credit application — even by routing it to an outside lender — the FTC classifies you as a "financial institution" under the Gramm-Leach-Bliley Act, which means the Safeguards Rule applies to you, and a Written Information Security Program (WISP) is the core document the rule requires. There's a narrow small-business exception, but most independent dealers don't actually qualify for it.
Why dealers assume they're exempt
A lot of independent dealers hear "financial institution" and picture a bank, not a used car lot. That assumption is understandable and wrong. The FTC has been explicit that the definition covers any business significantly engaged in financing or facilitating the purchase of consumer goods — which includes auto dealers who arrange financing, even when the actual loan comes from a third-party lender rather than the dealership itself.
If your dealership does any of the following, you're covered:
- Offers in-house or buy-here-pay-here financing
- Arranges financing through outside lenders as part of the sales process
- Handles leasing agreements
- Collects and stores credit applications, even temporarily
That's most independent dealerships in the country.
The exception that doesn't apply to most dealers
There's a limited exception for financial institutions maintaining customer information on fewer than 5,000 consumers. On paper, this sounds like it might cover a small independent lot. In practice, it's easy to blow past that number without realizing it — every credit application, every trade-in with financing, every lease agreement adds to the count, and it accumulates faster than most owners expect. The burden of proving you qualify for the exception falls on you, not the FTC, which means you need actual records showing you're under the threshold — not just an assumption that you probably are.
What happens if you don't have one
Not having a WISP isn't a passive risk — it's an active liability with two separate exposure points. First, if a lender or floor-plan partner asks for proof of compliance (increasingly common) and you have nothing to show, that can affect your financing relationships directly. Second, if a data breach happens and you have no documented security program, you're not just dealing with the breach itself — you're dealing with an FTC violation on top of it.
What to do next
If you're not sure whether you're covered, the fastest way to find out is to run through an actual assessment rather than guess. Sterling Safeguard's free risk assessment tells you in about five minutes whether your dealership falls under the rule and, if so, exactly where your current documentation stands.