GLBA Safeguards Rule enforcement in 2025: The training gap that kept showing up in consent orders

The FTC's updated Safeguards Rule, effective in 2023, gave financial institutions a clear set of security obligations, including an explicit requirement to train all personnel to safeguard customer information. By 2025, enforcement had matured enough to reveal a pattern, and it was not a flattering one for the organizations involved. Consent order after consent order cited missing, incomplete, or undocumented employee training. The lesson was blunt: training is not optional, and training that cannot be proved might as well not have happened.

The enforcement landscape in 2025

Through 2024 and 2025, the FTC pursued a steady stream of Safeguards Rule actions against mortgage brokers, auto dealers, tax preparers, and other covered financial institutions. Many followed data breaches, but the FTC's posture was clear that it evaluates the adequacy of the security program, not just the incident itself. A recurring theme across the consent orders was that organizations had not implemented the full set of required safeguards, and training was frequently among the missing pieces.

The recurring training findings

The specific training findings were remarkably consistent. Some organizations had no formal training program at all. Others had trained only some personnel, excluding the very employees, like sales staff or call-center workers, who handled customer information daily. Still others had conducted training but could not produce records of who completed it, when, or on what topics. In each case, the gap was the same: the organization could not demonstrate that it had actually trained its workforce to safeguard customer information.

Why documentation matters more than the training itself

A hard truth emerged from the enforcement actions: a training session that is not documented is nearly worthless in a compliance context. The FTC, like most regulators, evaluates what an organization can prove, not what it claims. A financial institution that says it trains its employees, but cannot produce a roster, completion dates, or certificates, is in essentially the same position as one that did not train at all. Documentation is what turns training from an anecdote into a control.

What a defensible program looks like

The organizations that avoided training findings shared a few characteristics. They trained all personnel, not just a subset, and delivered training on a regular schedule, typically annually, with additional onboarding for new hires. They covered the topics the rule expects: the risks to customer information, the organization's policies, how to identify and report incidents, and proper data handling. Most importantly, they kept records, including completion rosters with names and dates, certificates with unique identifiers, and a summary of the curriculum. When the FTC asked, they could produce it in minutes.

How to avoid the same findings

The practical takeaway for any covered financial institution is straightforward. First, confirm you are in scope, because the definition of a financial institution under the rule is far broader than most people assume. Second, implement training for all personnel, including new hires and anyone who touches customer information. Third, document everything, from the curriculum to individual completion records. Fourth, review the program at least annually and when the security program changes. None of this is complicated, but it has to be done deliberately and on a schedule, not reactively when a breach or an inquiry arrives.

The cost of getting it wrong

The consent orders of 2025 made the stakes concrete. Organizations that failed on training faced enforceable orders, compliance monitoring, and in some cases financial penalties, on top of the reputational damage of a public action. The irony was that the training gap was often one of the cheapest to close. Compared to deploying new technology or rebuilding systems, standing up a documented awareness program is inexpensive. The organizations that treated training as a formality learned that regulators do not. The ones that treated it as a real control, documented and current, stayed out of the headlines.