Short answer: Floor-plan lenders and finance partners typically want to see four things when they ask a dealership to prove FTC Safeguards Rule compliance: a named Qualified Individual, a dated written risk assessment, documented employee training records, and a written incident response plan. A verbal assurance that "we take security seriously" is not proof — they want dated documents they can put in their own file.
Why lenders are asking now
Floor-plan lenders and wholesale finance partners carry their own regulatory exposure, and increasingly, that exposure includes the dealers they work with. If a dealer they finance has a data breach, the lender's own compliance posture can get pulled into the fallout. That's pushed a growing number of lenders to start requesting proof of Safeguards Rule compliance directly from dealers, sometimes as a condition of renewing a floor-plan agreement, sometimes as part of a periodic review.
If you've recently gotten a request like this, you're not being singled out. It's becoming standard practice, and dealers who can produce the paperwork quickly tend to have smoother renewals than dealers who need weeks to pull something together.
What lenders are actually asking to see
1. Who's your Qualified Individual? They want a name and a title, not a general statement that "management handles it." This should be a documented designation, ideally with a date.
2. Can you produce a written risk assessment? Not a policy statement — an actual assessment showing you identified where customer data lives and what risks exist. Lenders increasingly ask for the date it was last updated, since a five-year-old assessment doesn't reflect current systems.
3. Do you have employee training records? Specifically: dates, who was trained, and on what. A lender reviewing this wants evidence the training happened, not just a policy saying training is required.
4. Do you have a written incident response plan? Lenders want to know what happens on your end if something goes wrong — because a slow or disorganized response on the dealer side becomes their problem too.
What happens if you can't produce these
In most cases, nothing happens immediately — but it puts the relationship on notice. Some lenders will give a dealer a window (30, 60, 90 days) to get documentation in order. Others treat a pattern of non-response as a risk factor in future terms. Either way, scrambling to produce four documents you should have already had is a worse position than having them ready before anyone asks.
Getting ahead of the request
The dealers who handle these requests smoothly are usually the ones who already have this documentation centralized and current, rather than pulling it together reactively from old emails and filing cabinets. Sterling Safeguard generates exactly these documents — Qualified Individual designation, risk assessment, training records, incident response plan — and keeps them current, so a lender request becomes something you can answer same-day.