Summary: What customer data does your AP team actually touch? This blog explores where the FTC Safeguards Rule reaches into dealership accounts payable, from trade-in payoffs to deal jacket backup, and what reviewers want to see when the annual report comes together. Learn how to build an AP evidence packet before books close so proof of your safeguards is ready whenever someone asks.
Before the books close this year, someone will write your dealership's annual Safeguards Rule report for ownership. The FTC requires that report in writing, delivered "regularly" and at least annually.
At many single-rooftop stores, the person writing it may be the controller. Finance should be ready to answer one question: what customer data does AP touch? Safeguards programs tend to center on F&I, credit applications, and DMS logins, so AP is easy to overlook. It shouldn't be, because AP handles customer information every week in finance and operations workflows built on email and paper.
The sections below cover where the rule shows up in AP, what reviewers look for, and what to hand over. Smaller dealers (under 5,000 consumers) are exempt from the written report, risk assessment, incident response plan, and pen testing. The core safeguards still apply: access controls, MFA, logging, disposal, and vendor oversight. One more caveat: this is general guidance, not legal advice, so loop in your counsel on the specifics.
By now, dealers know the rule applies to them. The FTC's Safeguards Rule FAQ for automobile dealers says it covers "most automobile dealers who finance or lease automobiles." What gets less attention is which departments actually hold the protected data.
The rule protects customer information, not vendor information. A parts supplier's W-9 falls outside it (though it still deserves protection), while a customer's loan payoff falls inside it. That distinction matters because AP handles several streams of customer data that rarely get mapped:
The FTC's FAQ treats financing applications as customer information in every case, including "Applications you approved for financing or leasing." A copy sitting in an AP inbox or a filing cabinet by the copier still counts as customer information. The protection follows the data wherever it lands. Since most of it starts in F&I or sales, AP is where operations hands that data to finance.
Knowing where the data sits is half the picture. The other half is knowing who else can reach it.
Last fall's breach at credit reporting provider 700Credit exposed data on millions of consumers across nearly 18,000 dealerships. Attackers got in by exploiting a third-party vendor's API connection. The exposed data included names, addresses, Social Security numbers, and employment information.
It shows why the rule asks dealers to oversee their service providers, not just their own systems. The FTC's dealer FAQ even uses a shredding company that handles paper records as an example of a service provider. AP usually pays those providers, from the credit reporting service to the shredder, and keeps their contracts on file.
Inside the building, CDK Global's sixth annual State of Dealership Cybersecurity study surveyed 218 dealership executives and department heads. 78% of them cite email phishing as a concern, the highest of any threat in the study. Payoff requests and refund backup often arrive by email, which puts AP right in the path of that threat.
The person reviewing your program might be an owner, an outside accountant, a cyber insurer, or the FTC itself. Whoever it is, their questions follow the rule's core elements. On paper, those elements read like IT requirements, which is why AP gets skipped. Each one has a direct AP equivalent, though, and the six below are what a reviewer will ask about.
Everything starts with a written risk assessment that includes criteria for evaluating risks and threats. For AP, that means a short inventory of which payment types touch customer information. It should also note where the supporting documents live and who can open them. Memory doesn't count here: "ask Linda, she knows where everything is" isn't a data map.
Who can open the payoff folder today? Every AP clerk, rooftop office manager, and last spring's temp may still have access. The FTC's guidance says to "Determine who has access to customer information" and to recheck that access periodically. The proof is a dated access review showing who lost access and when.
Could you show who opened a customer refund file last month, and what they did with it? The FTC expects you to "Maintain a log of authorized users' activity" and requires multifactor authentication for system access. A shared drive with one login per office can't answer that question, and a filing cabinet can't either.
Disposal has a deadline: "no later than two years after your most recent use of it to serve the customer." Exceptions exist for legitimate business needs and legal requirements. Plenty of dealerships have a retention policy on paper. Far fewer can prove they follow it for documents scattered across inboxes, desktops, and banker's boxes in the parts mezzanine.
The rule also expects you to regularly test whether your safeguards actually work. A written policy is a good start, but reviewers want proof it held up on a busy Saturday. For AP, the clearest proof shows who handled each customer refund or payoff and who approved it. In a well-built workflow, approval limits and separation of duties enforce themselves as embedded controls, and every step gets logged.
Breaches involving unencrypted information for at least 500 consumers trigger an FTC notice "no later than 30 days after discovery." That's a tight window, and only 47% of surveyed dealership leaders in CDK's study have a formal response plan. Scoping a breach that fast depends on knowing where the data sat and who touched it. A dealership with customer documents spread across six inboxes will burn most of those 30 days just finding them.
All six items come down to evidence. A manual process can meet every one of these expectations on a good day. The trouble comes at year-end, when someone has to prove it across 12 months, multiple rooftops, and thousands of transactions.
Much of that evidence lives in documents, which is where document management earns its keep. Capturing payoff letters, refund requests, and deal backup in one place, tied to the DMS, gets them out of inboxes. Permissions can limit who sees each document, and retention schedules can flag records past their disposal date. When the Qualified Individual asks where customer data lives in AP, the answer is one place with a full log.
Business process management is where the controls live. Approvals can route by amount, location, and payment type, so a large customer refund goes straight to the controller. Separation of duties is built into the routing instead of relying on someone to remember it. The workflow records who approved what and when, which turns item five into a report rather than a research project.
AP automation handles the transactions themselves. Invoices and payment requests can arrive with their supporting documents attached, matched, and coded before anything posts to the DMS. It closes the gaps where invoice processing tends to break down, which is often where customer documents go missing.
There's an upside past compliance, too. Dealers at NADA and ATD 2026 described compliance as an operating reality, and they wanted guardrails that don't add friction. Connected finance and operations workflows deliver that, and they spare your AP team a December spent hunting for approvals. The hours they get back can go toward finding cash and managing vendor terms.
You don't need a new system to start. The goal is a short packet to hand your Qualified Individual, or to use yourself when writing the report. Here's what belongs in it:
Together, these give the annual report concrete evidence instead of general assurances. They also become the AP section of your written risk assessment. Gaps you spot now cost far less to fix than gaps a reviewer finds first.
The Safeguards Rule reaches further into the back office than most dealers expect. AP handles payoffs, refunds, and deal paperwork that all count as customer information. A reviewer will want proof of who sees that data, how long you keep it, and whether approvals actually ran.
A manual paper trail makes that proof slow and uncertain. When finance and operations work from one connected platform, you can pull the proof whenever someone asks. onPhase builds that for dealerships, with document management, business process management, and AP working together in one place.
The controls that satisfy a reviewer also happen to be the ones that stop fraud. Fraudsters hunt for the same gaps a reviewer does. Accounts Payable Fraud Lives in the Seams of Your Process shows exactly where those gaps tend to hide.