up:: Doing the Work MOC
PQC for Credit Bureaus and Consumer-Data Holders
An organization whose product is consumer records has the clearest post-quantum exposure in financial services and the least discussed one. The data has no natural expiry, because a date of birth, a Social Security number and a 20-year credit history describe a person rather than a transaction. And the rule that governs it, the FTC Safeguards Rule, does something no other US financial regulation does: it requires encryption and then defines encryption by reference to current cryptographic standards, which quietly makes staleness a regulatory condition rather than a technical one.
This note is general education about a federal rule, not legal advice. How the Safeguards Rule applies to any particular institution, and what any particular event requires, are determinations made with counsel.
The short version:
- 16 CFR 314.4(c)(3) requires encryption of all customer information in transit over external networks and at rest, with a compensating-controls path that a named Qualified Individual has to approve.
- ⭐ The definition is the load-bearing part. 16 CFR 314.2(f) defines encryption as a transformation “consistent with current cryptographic standards.” That reference moves when the standards move.
- ⭐ And the breach-notification trigger turns on the same word. A notification event is the acquisition of unencrypted customer information, so the definition above decides what counts.
- Consumer identity data fails the shelf-life test more completely than almost any other category, because the identifiers cannot be reissued.
- The practical work is a cryptographic inventory that can answer, in writing, which standard each system currently meets.
Why is this sector’s exposure different?
Because the data does not age out of sensitivity. Most harvest-now-decrypt-later arguments turn on whether a record captured today still matters in a decade, and for a payment authorization or a session token the answer is comfortably no. A consumer file is the opposite case: it is a durable description of a person, built to be linked across decades, and the identifiers inside it are the ones a person cannot change. Applying Mosca’s theorem here is uncomfortable in a specific way, because the shelf-life term is effectively unbounded and dominates the other two.
There is a second feature, and it is structural rather than technical. Consumer data is assembled from furnishers and distributed to subscribers, so it crosses organizational boundaries constantly by design. Every one of those transfers is protected by cryptography that somebody negotiated, and the estate therefore has a large Zone 2 surface made of counterparties rather than vendors.
What does the Safeguards Rule actually require?
Encryption, in both states, with one supervised exception. The text at 16 CFR 314.4(c)(3):
“Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest. To the extent you determine that encryption of customer information, either in transit over external networks or at rest, is infeasible, you may instead secure such customer information using effective alternative compensating controls reviewed and approved by your Qualified Individual”
Source: 16 CFR Part 314, eCFR. The Qualified Individual is the role designated under 314.4(a).
That is a materially stronger obligation than the neighboring sectors carry, and the comparison is worth having in front of you because these three rules are frequently discussed as though they were equivalent:
| Regime | Who | What it says about encryption |
|---|---|---|
| FTC Safeguards Rule, 16 CFR 314.4(c)(3) | GLBA financial institutions, including consumer reporting agencies | Required, in transit and at rest, with a Qualified-Individual compensating-controls path |
| 23 NYCRR 500.15 | New York licensed banks and insurers | Required, and the in-transit exception was struck by the Second Amendment |
| HIPAA Security Rule, 45 CFR 164.312 | Health plans and providers | Addressable, and the transit specification is further qualified “whenever deemed appropriate” |
Source: NYDFS, Second Amendment to 23 NYCRR 500, dfs.ny.gov; HIPAA implementation specifications, 45 CFR 164.312. Covered in full at PQC for Banks, PQC for Insurance Carriers and PQC for Healthcare and ePHI.
Why does the definition of encryption matter more than the requirement?
Because it is the part that moves. 16 CFR 314.2(f):
“Encryption means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key, consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material”
Source: 16 CFR Part 314, eCFR. Emphasis added.
A requirement written against a moving reference is a requirement that updates itself. The rule never names RSA, never names a key length, and never names ML-KEM, so nothing has to be amended for the obligation to change: when “current cryptographic standards” mean something different, the definition of compliant encryption means something different, on the same day, with no rulemaking.
That is ordinary regulatory drafting and it has an unusual consequence for this sector. Most organizations experience cryptographic obsolescence as a technical debt item with an internal owner and an internal deadline. Under a definition like this one, it also has an external one.
How does that connect to breach notification?
Directly, through the same word. 16 CFR 314.2(m) defines the trigger:
“Notification event means acquisition of unencrypted customer information without the authorization of the individual to which the information pertains. Customer information is considered unencrypted for this purpose if the encryption key was accessed by an unauthorized person.”
Source: 16 CFR Part 314, eCFR. Emphasis added.
⚠️ Read the two definitions together and the exposure is visible. Notification turns on whether information was unencrypted, and encryption is defined as consistent with current cryptographic standards. The question of whether a given dataset was “encrypted” for notification purposes is therefore a question about which standard its protection met, rather than only about whether ciphertext existed.
This note does not tell you how a regulator would resolve that, and nobody should represent that it has been tested. It is stated here because it is what the two definitions say when placed side by side, and because it converts an algorithm-inventory question into one that a general counsel will recognize on sight. The defensible position is the same either way: be able to state, per system, which standard the protection currently meets, and when that was last checked.
Where does the cryptography actually live?
| Surface | Typical zone | Note |
|---|---|---|
| The consumer database and its backups | Zone 1 | The largest at-rest surface, and where key management decides everything |
| Furnisher intake feeds | Zone 2 | Thousands of counterparties on terms mostly set long ago |
| Subscriber delivery and APIs | Zone 1 and 2 | The bureau usually sets these terms, which makes them the easiest to move |
| Consumer-facing portals and disclosures | Zone 1 | Public TLS, the smallest problem and the most visible |
| Analytics, modeling and vendor environments | Zone 2 and 3 | Copies of the same records outside the primary estate |
| Long-term archives and legal holds | Zone 1 | ⭐ Where the oldest cryptography usually lives, protecting the oldest data |
The last row deserves the first look. Archives accumulate protection chosen at write time, so a 2012 archive holds 2012’s algorithms, and archives are precisely the datasets whose contents remain identifying. Key management tends to be the binding constraint on fixing it rather than the algorithm choice.
Common misconceptions
“Our encryption is compliant.” It was compliant against a standard, on a date. The rule’s own definition points at current standards, so compliance is a statement with a timestamp on it.
“Old records aren’t a risk, the reporting periods expire.” Reporting limits govern what may be furnished to a subscriber. They are not retention limits, and the identifiers in an aged file identify the same person.
“We’d rely on the compensating-controls path.” That path exists and requires a named Qualified Individual to approve it in writing, which makes it a documented, attributable decision rather than a default.
“Post-quantum is a 2030 problem.” The records being written this week are the ones with the longest remaining sensitivity, so the exposure accrues at write time rather than at migration time.
Questions people ask
What is the smallest useful first step? A written answer, per system, to which cryptographic standard the protection currently meets. That single artifact serves the inventory, the Qualified Individual’s decisions, and any conversation with counsel about the definitions above.
Does this reach data brokers who are not consumer reporting agencies? The Safeguards Rule reaches GLBA financial institutions, and the FTC has read that category broadly. Whether a specific business falls inside it is a question for counsel, and the shelf-life exposure exists either way.
How do we move furnisher and subscriber connections? Subscriber-facing terms first, because the bureau usually sets them. Furnisher intake is the slower half and it is a contract-renewal exercise, which is what procurement language is for.
Is a CBOM worth producing here? Yes, and specifically for the archive and analytics estates, where copies of the same records sit under cryptography nobody has looked at in years. See CBOM.
Should we be asking our own vendors these questions? Yes, and the questions are in the vendor-claims checklist. A vendor holding a copy of the consumer file is holding the same exposure with none of the regulatory attention.
What about hybrid? For anything negotiating with a counterparty, hybrid is where the deployed ecosystem is. Hybrid vs Pure PQC covers why.
Who owns this internally? Security owns the inventory and the Qualified Individual owns the exceptions, and in this sector general counsel has a genuine stake because of how the definitions interlock. That is a three-signature artifact rather than a security-team document.
Everything here is the map, given freely. When an organization needs a per-system statement of which cryptographic standard its protection currently meets, and its archives brought into that answer, that’s the work I do.
Last verified 2026-09-07 · Updated 2026-09-07 · Maintained by Addie LaMarr, LaMarr Labs.