The rule names appraisers. Then it says the homeowner is not your customer. Both sentences are real.

Is a real estate appraiser a financial institution under the FTC Safeguards Rule?

Yes, and the rule says so by name rather than leaving it to be worked out. Section 314.2(h)(2) gives thirteen worked examples of what counts as a financial institution. The third reads:

It is worth seeing the company that sentence keeps. The same thirteen-item list also names, at (x), an entity that provides real estate settlement services, and at (xi), a mortgage broker. The appraiser, the title company, and the mortgage broker are all financial institutions under one rule, named in one list, working on one transaction. Which regulator enforces it depends on the counterparty. A bank or credit union answers to its own prudential regulator rather than to the FTC, as 314.1(b) sets out. An independent mortgage lender or broker with no such regulator sits under this rule, the same one that names you.

Two things this does not depend on. It does not depend on your firm's size, and it does not depend on being state-licensed or state-certified, which is a separate regime with separate obligations. The rule asks what activity your business engages in, and appraisal is on the list.

The rule answers its own question, in section 314.1(b)

The scope section of the Safeguards Rule closes with a sentence that resolves the whole thing, and it is the sentence most summaries omit:

That is the answer, stated by the rule rather than inferred from it. Work through it with an ordinary lending assignment:

1. 1The lender is a financial institution. Nobody disputes this, and 314.2(e)(2)(i)(B) makes the relationship explicit: a consumer has a continuing relationship with you if the consumer "Obtains a loan from you."
2. 2The borrower is that lender's customer. Which makes the borrower's file, in the lender's hands, customer information.
3. 3The order reaches you carrying pieces of that file. The borrower's name and the subject property address at a minimum, and very often more: the contract, the loan number, the loan amount, the parties, sometimes the purchase agreement itself.
4. 4314.1(b) applies the rule to it in your possession. The sentence names your exact situation: information that "pertains to the customers of other financial institutions that have provided such information to you."

So the obligation does not arrive through a relationship with the homeowner. It arrives with the file. An appraisal practice that never signs a consumer as a client can still be holding customer information the moment a lender sends an order, and the rule says so without requiring anyone to interpret it.

Why most appraisers have never been told any of this

There is a straightforward, checkable reason, and it is worth stating carefully because it is a measurement rather than an accusation.

The FTC publishes a plain-language guide to the Safeguards Rule, which states on its face that it "serves as the small entity compliance guide under the Small Business Regulatory Enforcement Fairness Act." It is the document a small firm is most likely to find first, and for most purposes it is an excellent one. Describing who is covered, it says the rule's Section 314.2(h) "lists 13 examples of the kinds of entities that are financial institutions," and then names them:

Read that list again looking for your own trade. The word appraiser appears once in the text of Part 314 and does not appear in that summary. An appraiser who checks the guidance, finds no mention, and concludes the rule is aimed elsewhere has done a sensible thing and reached the wrong answer.

What settles it is the rule, not the summary of it. 314.2(h)(2)(iii) names appraisers and 314.1(b) applies the part to customer information in your possession. Neither sentence is affected by which examples a guidance document chose to repeat.

Two years to dispose, unless the law says otherwise

Appraisers are among the few covered businesses with a professional obligation to keep files for years, which makes the disposal element read like a collision the first time through. It is not one, because the rule anticipated it. Section 314.4(c)(6)(i) requires procedures to securely dispose of customer information "no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates," and then names its own exceptions. The information may be kept where it is necessary for business operations or other legitimate business purposes, where it "is otherwise required to be retained by law or regulation," or where targeted disposal is not reasonably feasible.

That middle exception is the one that carries appraisal practice. A retention duty imposed by your state licensing regime or by the professional standards you work under is a reason the rule already accepts. The duty that remains is narrower and more practical: know which retention obligation applies to you, keep what it requires, and securely dispose of what falls outside it rather than keeping everything forever by default.

Two honest notes on this. The specific retention period that applies to you comes from your state and from your professional standards, and this page does not state one, because the question is answered by documents outside the FTC rule. And "securely dispose" in 314.4(c)(6) means what it says: material in a cloud mailbox or a storage account is disposed of when it is actually gone, which is a different operation from moving it out of sight.

Thirty days, five hundred consumers, and the word that starts the clock

Since May 13, 2024, the Safeguards Rule has carried a reporting duty. Section 314.4(j)(1) requires notice to the Federal Trade Commission "as soon as possible, and no later than 30 days after discovery of the event" where a notification event involves the information of at least 500 consumers. The notice goes on an electronic form on the FTC's website and must state who is reporting, the types of information involved, the dates if determinable, the number of consumers affected or potentially affected, and a description of the event.

The FTC's guidance describes the triggering event as a breach "involving the unauthorized acquisition of at least 500 consumers' unencrypted information," and adds a detail worth holding onto: unencrypted "includes encrypted customer information when its encryption key was accessed by an unauthorized person." Encryption is a defense that can be undone by the loss of the key, and the rule accounts for that.

Discovery is the word that starts the clock, and it is defined more broadly than most people assume. Under 314.4(j)(2) an event is treated as discovered as of the first day it is known to you, and knowledge is imputed from any employee, officer or other agent other than the person who committed the breach. The trigger is discovery of a qualifying notification event rather than any suspicious observation, so a strange login on its own does not start anything. But once an event does qualify, the day a staff member knew of it can be the day the thirty days began, whether or not it reached the owner that week.

Two features of this land hard on a small practice. The 500-consumer threshold counts consumers, not clients, and a compromised mailbox holding a decade of lending assignments can pass it without the practice ever having had 500 consumers of its own. And this duty survives the under 5,000 exception entirely: 314.6 lifts the written incident response plan at 314.4(h), and does not lift the reporting duty at 314.4(j). A firm can be exempt from the written plan for handling an incident and still owe the report within thirty days of discovering a qualifying notification event.

Whether a specific event is a notification event, and what any given practice must do about it, is a determination for the firm's own counsel. What is stated here is what the rule says.

Where the facts on this page come from

Every quoted sentence on this page was read from a primary source on September 11, 2026. Where a claim could not be sourced primarily, it was left off rather than softened.

• 16 CFR Part 314, the FTC Safeguards Rule. Read in full from the eCFR, which publishes the current text of the Code of Federal Regulations. Sections quoted: 314.1(b), 314.2(d), 314.2(e), 314.2(h)(2), 314.3, 314.4(a) through (j), 314.5, and 314.6. eCFR, 16 CFR Part 314
• Federal Trade Commission, FTC Safeguards Rule: What Your Business Needs to Know. The source of the thirteen-example summary, the description of 314.6 as an exemption from certain provisions, and the unencrypted-information detail in the breach notification section. ftc.gov business guidance
• Appraisal Subcommittee, USPAP Compliance and Appraisal Independence. A federal source for the professional-ethics framing, which lists failing to protect the confidential nature of the appraiser and client relationship among USPAP ethics violations. asc.gov

Deliberately absent: any retention period from USPAP or state law, any count of appraisers or appraisal firms, and any breach or loss statistic scoped to appraisal. None of those could be established from a primary source, so none is asserted. This page is general information about a published federal rule and is not legal advice.