AegisAI Perspectives · 035
A financial firm must pick an email security provider able to keep safeguards, require them by contract, and reassess it by risk under 16 CFR 314.4(f).
Under 16 CFR 314.4(f) of the FTC Safeguards Rule, a financial firm must pick an email security provider able to keep the safeguards, require them by contract, then reassess it periodically by risk123. The firm stays accountable: the buck still stops with the company5. AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery15, so each verdict and its reason stay in view17.
Provider oversight is one control in what email security a financial services firm needs. The steps below cover the email security provider under 16 CFR 314.4(f).
Confirm the provider is in scope, check it before signing, write the safeguards into the contract, trial it, then reassess it on a schedule set by risk. Eight steps cover it.
Confirm the provider is in scope. A service provider is any entity that receives, maintains, processes or is otherwise permitted access to customer information through services to the firm4. An email security tool reads inbound mail, and that mail carries customer information.
Check capability before signing. Section 314.4(f)(1) requires reasonable steps to select providers capable of maintaining appropriate safeguards. Ask which mailbox permissions the tool needs and who can revoke them.
Write the safeguards into the contract. Section 314.4(f)(2) requires them by contract. The FTC says the contract must spell out security expectations and build in ways to monitor the provider's work6.
Set breach notice terms. The firm must notify the FTC no later than 30 days after discovering a breach involving at least 500 consumers8. Require the provider to report incidents fast enough for the firm to meet that clock.
Trial the tool read-only on your own mailboxes. Keep removal rights off until the trial results are reviewed. Then grant write access for removal in a named change.
Verify payment requests by a second channel during and after the trial. The FBI advises secondary channels or two-factor authentication to verify changes in account information13.
Reassess on a schedule set by risk. Section 314.4(f)(3) requires periodic assessment based on the risk the provider presents and the continued adequacy of its safeguards. Record each review date and result.
Keep ownership with the firm. The Qualified Individual may work for a service provider, but that provider then needs its own information security program that protects the business7.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, as its inbound email security page describes. It runs in monitoring mode first19. Removal needs write access the firm's admin grants and can revoke18. It investigates every email for what it is trying to do and removes the ones that fail from every mailbox they reached16.
Three duties sit in the FTC rule text, and New York and the bank regulators add their own. The table maps each duty to its source and the evidence an examiner would ask for.
| Duty | Where it is written | Evidence to keep |
|---|---|---|
| Select providers capable of appropriate safeguards | 16 CFR 314.4(f)(1) | Due diligence notes, permission list |
| Require safeguards by contract | 16 CFR 314.4(f)(2) | Signed contract with security terms |
| Assess providers periodically by risk | 16 CFR 314.4(f)(3) | Dated review records |
| Contract spells out expectations and monitoring | FTC business guidance | Contract clauses, monitoring reports |
| Notify the FTC of a breach of 500 or more consumers within 30 days | 16 CFR 314.4(j) | Incident notice terms |
| Written third party provider policy with due diligence and periodic assessment9 | 23 NYCRR 500.11(a) | The policy, signed off |
| Provider guidelines on access controls, multi factor authentication and encryption10 | 23 NYCRR 500.11(b) | Provider attestation |
| Risk management across the life cycle of a third party relationship12 | Federal Reserve SR 23-4 | Life cycle file per provider |
A review passes when each part of 314.4(f) has a dated record behind it.
Illustrative example, figures are fictional. A consumer lender with 120 mailboxes picks an email security provider in March. The due diligence note lists the mailbox permissions the tool asks for and the admin who can revoke them. The contract names the security expectations, a monthly verdict report and a 72 hour incident notice. The tool runs read-only for 30 days and flags 41 messages, each with a written reason. Finance staff call back on 3 payment change requests and find 2 fraudulent. Removal rights go live in April. The September review compares the provider's reports with the lender's own incident log and records the result.
It requires three things in 16 CFR 314.4(f). Select providers capable of maintaining appropriate safeguards. Require those safeguards by contract. Assess providers periodically, based on the risk they present and the adequacy of their safeguards. Outsourcing does not move the duty: the FTC says the buck still stops with the company.
They fall under it through the definition of service provider in 16 CFR 314.2. That covers any entity permitted access to customer information through its services to the firm. An email security tool reads every inbound message to decide on it. When customer information travels in those messages, the tool has access to it. Encryption of the same messages is covered in whether the Safeguards Rule requires email encryption.
Pick one you can show is capable of maintaining appropriate safeguards. Ask for the mailbox permissions it needs, how removal rights are granted, and how each verdict is explained. Size the risk with the FBI's numbers: IC3 received 24,768 business email compromise complaints in 202520, with $3,046,598,558 in reported losses21. How a tool reads intent in a message is set out in how AI powered email security works.
Mandate the security expectations, a way to monitor the provider's work, and periodic reassessment of its suitability. New York's Part 500 adds guidelines on the provider's access controls, multi factor authentication and encryption. It also adds notice of cybersecurity events and representations about the provider's security policies11. Tie the notice clause to the FTC's 30 day breach clock. Account controls are covered in the Safeguards Rule multi factor authentication guide.
Set the cadence by risk, as 314.4(f)(3) requires. A provider that reads every message of the firm presents more risk than one that sees a single mailbox. New York requires periodic assessment of providers in a written policy. Bank regulators cover all stages in the life cycle of a third party relationship. Compare the provider's reports with your own incident log at each review.
Answer each question yes or no, and attach the record.
Track three numbers.
Select a provider capable of appropriate safeguards, require those safeguards by contract, then assess it periodically by risk. The firm keeps responsibility for the program throughout.
Yes, when it receives, maintains, processes or is permitted access to customer information through its services. An email security tool reads inbound mail that carries customer information.
The firm. The FTC says that when a service provider runs the program, the buck still stops with the company.
The rule sets no fixed interval. It requires periodic assessment based on the risk the provider presents and the continued adequacy of its safeguards. Write the interval and the reason into the provider file.
Contact the originating financial institution as soon as the fraud is recognized and request a recall or reversal. Then check whether the event triggers the FTC notice rule for 500 or more consumers.
