FTC Compliance with Chris Farrell - Part 1

Welcome to Accountants LawPod, where accounting professionals and law firms converge. Hosted by Lynda Artesani, Sarah Prevost, and Stephen Libhardt.

Hello everybody, and welcome back to our podcast. And this week we have a very interesting topic. I kind of call it a dry topic. It's FTC compliance, but it's actually been kind of a buzzword amongst us accountants and bookkeepers. And we have a special guest with Chris Farrell, and he's gonna tell us what he knows about that. So welcome, Chris. I guess we can dive right in because it is definitely a topic of intrigue.

And importance.

And importance.

We really, yeah. I'm excited. I'm excited to learn.

And Chris Farrell's from Lysio. And if you are watching on YouTube, we all have our Lysio shirts on. I don't have one. And he's a dear friend of ours from a long time.

Love it.

Well, thank you, Lynda.

Thank you, Sarah, for having me on.

Of course. We love having you on. We always have good conversation with you. We do.

Yeah.

Love it.

So teach us, what is it that's coming? Like, or it is now, right?

It is. I think the FTC has weighed in. The Federal Trade Commission has said it's time, right? It's time to take care of personally identifiable information and client information, right? Mm-hmm. So a lot of people have been pretty lax. You've probably read about it in the Journal of Accountancy. You've heard about it through the IRS Publication 4557 and many other publications. You've heard it from the IRS Dirty Dozen, things to not do and to watch out for. So much client information has been in emails, so much client information has been in texts, so much client information is actually leaked out on the dark web. This is really, really bad stuff. And what have we been doing as a profession for a long time? Probably a little bit of a head in the sand. I know you all aren't. You've taken security very seriously from jump. Mm-hmm. I hope that's paid off really well for you. But I think in general, when you think about where the profession has been, it's been same as last year, which is email's been in use and circulation for 30 years. People are saying, my clients won't change. There's a lot of excuses around it. The FTC is saying, you know what? You have to move, right? And it makes sense. I think most clients have moved their banking entirely off of email, the relationships entirely inside of secure apps and so forth. And it's been that way for the better part of a decade already.

Mm-hmm.

So when is the accounting profession going to follow suit and play ball with what everything else happening in the consumer space, right, has done? When is that gonna happen? The FTC says it's probably not going to happen unless we start saying something, unless we start putting fines behind it. So here they come. Here they are. And that's more or less the world we're about to live in.

It's lofty fines too, right?

Heavy fines. It's heavy fines. I think the reality is if we all kind of look at it and say, look, the majority of the accounting profession is small firms, right? One person in the practice, two people in the practice, maybe 3, 4, or 5. That's really where the majority is. People are probably thinking, hey, you know what? The chance of the FTC coming after me are pretty low. I think we would all agree with that. How could you enforce it across 200,000 firms just in the US? Seems unenforceable, doesn't it? I think there's this other reality though, which is there's a market force which is going to really get everybody in line. And the market force is the threat is so real and has been so real and so pervasive for so long that the FTC and the IRS are saying, we're done fooling around, you have to do this. And they've been asking us politely every year. If you do taxes, they ask you for a PTIN renewal.

Mm-hmm.

It has you check a box saying you are protecting client information. People have been checking that. Some people, maybe the majority we might argue, have been checking that blindly. Yeah, I'm doing that, I'm not doing that, but I'm just gonna check the box and move on. I think with that in the, you know, as kind of the backdrop, people have, you know, let their guard down a little bit. The market force that's going to correct it is going to be cyber insurance. Most firms have cyber insurance today.

Mm-hmm.

Most firms. But if you watch what's happened with cyber insurance, number one, cyber used to be the least expensive insurance option that you could get out of the big ones. Like, it was professional liability and so forth, more expensive. Cyber insurance, starting I think maybe a year or two ago, became the most expensive part of business insurance for accountants. Cyber moved to number 1. The market forces, ransomware, all this stuff has pushed that to that point. It's not going to get any cheaper. The issue I think that people are having now is they're finding out that if they blindly check those boxes and aren't following what they say they're doing in order to get cyber insurance, number 1, if they don't have out cyber insurance, they're not able to get it. Big risk. Number 2, if they have cyber insurance and they aren't doing what they say they're doing and they're not compliant with the FTC regulations and so forth, what's gonna happen? The insurance isn't gonna pay out. So premiums are being paid today by a lot of firms that are likely to be ignored. And we're already seeing this in the insurance company's reviews. Oh, you got ransomware or a bunch of client information leaked out. But you weren't following the guidelines. Therefore, that's not our fault as an insurer. That's your fault as a business. You're on your own.

I guess is, is the change. So the change, it's been in effect, but the change is now you have to, you're beholden to the, the rule. And it's not just tax firms, it's everybody that's in the space, right? Like that's offering services that for it. So just because you have the P10 and you're doing it that way, it's not that. You— it's for all, all of us doing any sort of accounting work, right?

Depends on how much PII you have, how much client information you have. You have a tiny, tiny bit, like if you're a one-person bookkeeper booking for 12 clients, I think you, you have— you're not gonna have the FTC. I, I don't— quote me on this, but in my personal opinion, the FTC is not going to get involved. I think it's highly, highly unlikely.

Yeah.

Not remote, right? I think what's more likely to happen is if you choose to ignore all this stuff, right? Really, the real risk is the cyber insurance part and the threat to the business. Why go build a business up, get all these clients, and then be so wildly out of compliance by ignoring all the basic business standards?

Yeah.

That seems like an existential risk to the firm. So why take that risk on? But I think the FTC has regulations around it. I think the minimum standard is If you have contacts, I think it's 5,000 contacts, you have 5,000 contacts in your database, you have to comply with the FTC Safeguard Rule. If you do any tax returns, any at all, the standard is you must comply with 4557/FTC, right?

Sure, yeah.

It's not gonna apply to everybody, but I think we're looking at really this broad standard that everybody should take a look at.

Yeah.

And we should all conform to it regardless. I mean, you could accumulate if you're a firm that's been in existence for a while, you could accumulate to that 5 and not realize that you've retained old data. It's like old files in the filing drawer.

And it's also relates to a number of people, right? So if you have, let's say you do bookkeeping, you've been doing bookkeeping for firms and the average size of the, let's say you do restaurants, restaurants get a lot of people going through payroll. You're gonna get a lot of people in a year. A 25-person restaurant might have 50 different employees just for that one restaurant or a couple of years.

Yeah.

Accumulate hundreds and hundreds of employees worth of records underneath a single restaurant.

Yeah.

Right? And so you can sneakily get there. So I think the point there though is really, look, if you're worried about client data and you're worried about your fiduciary duty, The, you know, we're at the point now in the market where there's so much risk, there's so much risk that the largest government regulatory bodies are coming in saying, pay attention. If you don't pay attention, there are repercussions. And the market force on the insurance side is doing the same thing.

And, you know, and as a business owner, and now we have quite a few employees now, more than we had a few years ago, you know, you have to be, hoping and making sure you put in workflows and processes with everybody, revisiting this. We talked about this when we first got notified about this change. We talked about the staff and they were like, well, what does that mean? Does that mean we can't— because some of our clients like to get an email with their financial statements. Like, no, you have to make sure we stick to— we use Lycio, stick to inside the product, stick to where it's safe. And there should be no pushback. If there's pushback, now we have another way we can say, look, we're trying to keep your data safe. So it depends on what's on it. But I know with payroll and anything sensitive like that, and you have to have a place to store and, and communicate with your client because you don't want— I, I, that was the reason why I went to Lucidio was I didn't want too many people were emailing me the driver's license, the, the everything I need, Social Security, they fill out the W-2, the W-4, and I'd be getting this data set that was like, here you go, who wants to steal the data? And And you don't wanna have that exposure and you don't wanna do that to your clients. You know, it would be awful if a client's data got stolen because it was in your hands. I would feel terrible about that. So, and, but when you get bigger, the larger the firm, now you're not the only one doing the work.

You have— You have, you have the innovative solution, Lynda, right? You had the most innovative solution that we saw.

Yeah.

You wanna tell everybody about that?

Well, when I told my, I had one client out of all of them when I made the switchover, because it's hard to change software. And I said, this is what I'm doing now. And he's like, I don't want another app. I don't want more software, but I'm not gonna do it. He said, I'm not gonna do it. And I told him, well, I'm not gonna hold the responsibility of taking care of your data. And you're, you're telling me you want me to email you all this stuff. I'm gonna push that responsibility on you. I want you to sign a waiver form. I'm gonna put it together for you. I didn't have one, but he didn't know that. And he was like, oh, oh, oh, I don't wanna sign a waiver. He did not wanna take that responsibility. It was okay to throw it in my lap. So You know, we ended up— he's actually really good on Lycio too. He's like, everything's communicated nicely and everything's in there. And one client I had too, somehow he deleted his Google account and he had shared all these documents with me. And it was so funny because he's like, I deleted my entire Google and they can't get it back to me. And I'm like, well, we have everything stored here in Lycio. You know, the files are here. He was so happy. It was like his original spreadsheets of all his back trust data. And he was like in heaven that we had it all because we asked for it. And he's like, oh my God, it's there. I said, yeah, it's not, it didn't get deleted. I don't know how he deleted his Google, nor do I want to know.

Well, you had the story, which I mean, we've all had it, where somebody kept getting fraudulent, you know, they had to close their bank account down and change their bank account. What the heck does this person do?

Send an email.

Send an email.

Log it to the bank. After they logged it, they emailed it to me and I'm like—

But that's the, I think, Chris, that's the part that's very hard is you don't control the input. The in, you try as a firm owner, but you cannot do that.

It's hard to control everybody that has it unless you firmly put processes in place, which we revisit. Like, this is what we do. This is company policy.

Yeah.

There's no wiggling off of that. You're gonna be in big trouble if you do something. I don't care how much the client wants it sent by email. No. And they get a notification so they know it's there and then they go back and they get it. It's just some people are like, I hate to say they're my age, they're old and they just like, like their email and they don't, they're the ones that are probably clicking on some website that's not right, that they get hacked in. You know, that's the typical person that would probably, I think of my husband, he would probably click. On something that he's not supposed to. And then I'd be like, Lynda, can you fix this? Because he'll have a virus on his computer. Same thing. You just want to protect from all that. And so as far as FTC goes, yes, that's there. But also as a, as a human and as a business owner, you just don't want to expose your clients at all. I mean, there's ways to make sure they're secure.

I think, you know, for, from our, as long as we know each other, you've always had such, you both have always had such a clear vision about whom you wanna work with, right? You don't have this whole legacy client base that I think a lot of firms frankly are struggling with, particularly tax. You know, I've been serving this tax client for the last 30 years, 40 years. They're wonderful. We have a great relationship. I can't get 'em to move. So we have to understand like a lot of firms can't be purists around that.

Yeah.

And you know, us for a long time as well, we came out saying, look, everybody should do this. Therefore, this is what we built. But I think we had to relax our stance as we came closer to the reality for a lot of firms, which is you're right. There's somebody who's— who needs a lot of help. They aren't technology savvy. They can barely do email. OK, how do we find a way to work within that bubble? And I think the reality is it's kind of like banking. When you work with your bank, banks do most of their transactions now through the secure website, through a mobile app. Most.

Yeah.

But they're not taking away the branch, they're not taking away, you know, their ways of serving us, right? What they've done is they've built a really attractive bridge to the future, but they're maintaining some, you know, one firm foot firmly in the past, right? Mm-hmm. So we think about that, it's like, oh, okay, most firms are gonna have to do something like that. So our approach has been like, we'll build the, we have the email integration, the SMS texting, right? So if your clients are doing that, We can continue to encourage them over to the right side. So we can over time build a bridge from where they are today to where you want them to be tomorrow. And it's been highly, highly successful with banks. Like bank app adoption is the super majority. Mobile banking is much more than web banking now. And did they ever twist our arms?

Nope.

No.

No. Not at all. They offered it so we didn't have to go to the bank. That was the big thing. Like, oh my gosh, not having to go to the bank is great.

Well, now what's the deal? You make appointments to go into the bank depending on the level of what you are. So it, to your point that you brought up in the initial, consumer has been, the consumer side has been doing this for so long. The adoption of it on this side of the fence has been the slowest churn probably ever.

And you can retrain your clients. So every once in a while they'll go back to email and then I don't answer it. I wait till Friday. So if it happens during the week and they tried to email me on Friday, and then I take that email, which now we don't have to do, but I take that email and I send it back in Lysio. I answer them in Lysio and then I'm like, oh, and I'll write right in there. I'm sorry, I don't monitor that email. I communicate with all the clients. I live in this software. Be your security. And then it just retrains them, and then they get it, and they get back in the groove of it. It's just laziness, basically. It's like, what's the fastest way, right? And—

That's right. Because everybody's texting too, right? I mean, I don't— you all don't have this problem, but somebody texts, usually—

We do.

Texting. Attorneys text. A lot of attorneys text.

There you go. So use Liscio Texting, and when they text you something that you wanna make sure is secure, you just send the Liscio link back via text. But it's all coming from Liscio Text with the Liscio—

And not my phone number. Not my phone number. Want them to have.

Speaking of phone numbers, Chris, you kind of said this and Lynda, you said, so I had this experience and it's on the consumer side. I called into something and recognized my phone number. It immediately drops me in through, okay, which service do you want to, like, basically knew by my phone number what I wanted or potentially what I could want. And it was great. And then to the point where it was not great because it stayed still robo, stayed still like very friction-based. And I think what you're going to is I'm happy to meet as a service provider to all of us is you're looking at it through that lens of I'm happy to meet you in the middle somewhere because too much friction, it just becomes an angry, an ugly circumstance with the client. You want some sort of flow that's a little bit more native.

Mm-hmm.

And they'll eventually adopt it. I believe, is into a new space.

Because I think if you look at the whole problem here, like you got the person who said, hey, I don't want to use another system. I'm not gonna sign your waiver, so I'll use the system. What happened? The client's happy, right? You have somebody working in Gmail, delete their Gmail. There's always these moments which are gonna move you to something like, okay, I'll try this. And once you tried electronic banking, we never went back, right?

We never went back.

Yeah. Yeah.

It's the same thing. People are afraid of change. So there's gonna be a moment where they have to sign something or find something or send a file that's too big for email, there's always a moment that spurs trial. Once you spur trial, they realize, oh my gosh, it's got Face ID or whatever. This is easier than what I was doing before.

Yes.

Then they're over the hump. So I think if you look at texting, for example, within the context of the FTC, right? Texting within the context of FTC. So we're texting. Most firms who have 2, 3, 4 employees, The employees will start texting because the client is texting. Okay. What happens when that, when that person loses their phone or worse, what happens when that person no longer works for the firm?

Yeah, you have no control.

They walk out of the door with a mobile phone full of PII and client information.

Yeah.

In what world is that good? No world, right? You say, okay, look, the SMS has to— this is happening in practice with everybody. The SMS has to stay in the, in the core system. It stays in the core system and all of a sudden there's something like, hey, I need to send you my driver's license. Okay, great. You're gonna do that. This, you can send them a link from the same text message that puts them into the app with the scanner. Use this scanner. Yeah, yada yada. But you can do that in Flow without having to toggle between systems.

Mm-hmm.

And just make it dead simple to do that. That is gonna, you know, I think change the security stance for firms dramatically.

Yeah.

In addition, it's addressing this core need, which is how many people get an email and ignore it? Everybody. And so what do people do? Well, they send another email. Okay, if that doesn't get answered, what do they do? Either they call, which takes a lot of time, or they send a text message from their personal phone, which opens up Pandora's box for personal quality of life, right? But we know as accountants we have to get their attention. Therefore, why don't we use texting the right way? So if we go to a hairstylist, if we go to our dentist, if we go— heck, if we go out to make a dinner reservation somewhere, what do they do? Mobile app notification and text reminder.

Oh yeah, yeah, always. And even you shop right now. Can we add you? You'll get additional discount if you get Do you know what I mean? Like, yeah, texting you promotions. Well, at some point that's noise and I'm blocking or spamming or unsubscribing.

But yeah.

But if it's from your account or somebody you trust professionally.

Exactly.

Why don't you use a professional system for maintaining it? Because—

Exactly.

Putting it in a silo where, you know, you got employees, your employees can't see what's been texted to you. You can't see what's been texted to them. Now you've got this whole other channel you got to start to manage, which is, hey, did you do this? Or I need to get this to you. Or somebody texted you a document you need to get to your staff. You got to go onto your personal phone, download the documents, somehow convert it to a PDF, get it. Like, it's just a— it's just big.

It's a cycle. You know what's interesting too is when you're, um—

Hi, LawPod listeners. Tierra here, the girl behind the scenes. We had so much fun with today's conversation that we Well, we just didn't want it to end, so we thought we'd split it up into a two-parter. We hope you join us next week as we continue this great conversation.