AegisAI Perspectives · 020
The FTC Safeguards Rule requires encryption of customer information in transit over external networks, so email to outside recipients must be encrypted.
Yes. The FTC Safeguards Rule requires encryption of all customer information in transit over external networks, so email that carries it outside your network must be encrypted1. The rule sits alongside the controls in What email security does a financial services firm need? AegisAI reads each outbound email for customer data and checks its recipient against the sender's habits, then applies your policy.
The same paragraph of the rule covers information at rest, and it allows one exit: where encryption is infeasible, it accepts compensating controls that your Qualified Individual reviews and approves2.
Every financial institution under FTC jurisdiction must comply, including small ones. The rule covers the handling of customer information by all financial institutions over which the FTC has jurisdiction under the Gramm-Leach-Bliley Act8. Its examples include a retailer that issues its own credit card and a car dealership that leases vehicles for longer than 90 days9. A property appraiser counts too, as does a company acting as a finder.
Customer information is any record with nonpublic personal information about a customer, on paper or in electronic form6. A loan file, a statement or a tax return attached to an email qualifies. Institutions with fewer than five thousand consumers are excused from four provisions, and the encryption paragraph is not one of them7.
Encrypt every external email path that carries customer information, and write down the exceptions.
List the paths. Name every outside domain that receives customer information by email: payroll providers, title companies, auditors, customers themselves. Mark which ones send customer information back to you.
Read your default. Exchange Online uses opportunistic TLS and sends without encryption when the other side does not support TLS15. Gmail behaves the same way: it still sends when the receiving server lacks TLS, and the connection is not secure19.
Force TLS per partner domain. In Exchange Online, a connector can require TLS with a trusted partner, the setting Microsoft points to for banking16. In Google Workspace, the Secure transport (TLS) compliance setting bounces outgoing mail to listed domains over non-TLS connections20.
Publish MTA-STS and TLS reporting on your own domain. MTA-STS tells sending servers to refuse delivery to your MX hosts without TLS and a trusted certificate21. TLS reporting sends you a record of failed or unencrypted deliveries22.
Add message encryption where TLS stops. TLS encrypts the connection and not the message, so a forward to a server without TLS can travel in clear text17. A mail flow rule can require encryption for every message to a named recipient or with set words in the subject18. NIST SP 800-177 names S/MIME for encrypting message content23.
Protect the keys. The rule defines encryption to include appropriate safeguards for cryptographic key material3. Record who holds the keys for each method you use.
Write the exception. Where a path cannot be encrypted, describe the compensating control and get your Qualified Individual's review and approval in writing.
Log and lock the mailboxes. The rule requires MFA for anyone accessing any information system12 and logging of authorized users' activity13.
Before an outbound email is delivered, AegisAI checks what is in it, who it is going to and whether that is normal for the sender, then applies your policy, as the outbound email DLP page describes24. Teams run a policy in audit on live outbound mail first, then raise it to alert11. It runs on the same API connection that inbound protection uses, with no MX change, and outbound DLP is in early access with policy actions that depend on the email platform.
Standard opportunistic TLS is not a dependable answer to 314.4(c)(3), because it falls back to an unencrypted connection when the other server lacks TLS. Forced TLS closes that gap for the domains you list. Message encryption covers the copy that travels on after delivery.
| Method | What it encrypts | When the other server lacks TLS | Where you set it |
|---|---|---|---|
| Opportunistic TLS (default) | The connection | Sends in clear text | On by default |
| Forced TLS per domain | The connection | Message is not sent | Exchange connector or Gmail TLS compliance setting |
| MTA-STS on your domain | Connections to your MX hosts | Sender refuses delivery | DNS record and a policy file |
| Message encryption | The message itself | Message stays encrypted | Mail flow rule or S/MIME |
A misdirected email can be encrypted in transit and still expose customer data as a notification event, so staying compliant means checking the recipient as well as the path. In the 2025 DBIR, misdelivery made up 72% of the action varieties involving end users25.
Illustrative example, figures are fictional. A mortgage broker with 3,000 customers sends a spreadsheet of 640 borrowers, with Social Security numbers, to its title partner each month. Forced TLS covers that partner's domain. One Friday autocomplete picks a different address, at an outside company. The connection is encrypted, so the file arrives intact and readable in the wrong mailbox. The broker learns of it on Monday, and that is the discovery date. The file was unencrypted customer information acquired without authorization4. Because 640 is at least 500, the broker notifies the FTC no later than 30 days after discovery5. Had a mail flow rule encrypted the message itself, with the key never accessed, the file would not count as unencrypted.
Email encryption for Gmail and Outlook users works through admin settings in Google Workspace and Exchange Online, not through the mail client. The administrator sets the TLS compliance setting in the Google Admin console and connectors or mail flow rules in Exchange. The guide to cloud email security for Microsoft 365 and Google Workspace covers where those consoles sit.
Neither platform makes an institution compliant by default. Both try TLS first and still send when the other side cannot use it. The rule's duty sits with the institution, and service providers must be held to it by contract14.
The documentation that shows audit-readiness is the record of each email path with its method, plus any approved exception.
Track three numbers.
Customer information transmitted over external networks must be encrypted. Email to another company's server crosses an external network. Where encryption is infeasible, your Qualified Individual reviews and approves a compensating control instead.
The same paragraph covers customer information held by you at rest, which includes what sits in the mailboxes and archives you run. The infeasibility exception and Qualified Individual approval apply at rest as well.
No. In the 2021 final rule the FTC declined to extend the encryption requirement to data sent over internal networks, calling it unduly burdensome for all institutions at this time.
No. Both try TLS first and still deliver in clear text when the receiving server lacks TLS. Forced TLS and message encryption are settings an administrator turns on.
The small institution exception removes four provisions, the written risk assessment among them, and leaves the encryption paragraph in place.
