FTC Compliance with Chris Farrell - Part 1
13 Jul 2023 · 21 min
In this episode of Accountants LawPod, hosts Linda Artesani, Sarah Prevost, and Steven Libhart interview Chris Farrell of Lissio to discuss the Federal Trade Commission’s (FTC) new data‑security expectations for accounting and bookkeeping firms. The conversation outlines why the FTC’s Safeguards Rule and IRS Publication 4557 are now critical, especially as client personally identifiable information (PII) increasingly resides in emails, texts, and cloud storage. Farrell explains that while many small firms (often solo or with a handful of staff) may think they are unlikely to be targeted by the FTC, the real enforcement lever is market pressure—particularly cyber‑insurance requirements. Insurers are tightening underwriting: firms must not only purchase cyber policies but also demonstrably follow the FTC’s safeguards, or risk denial of coverage. The panel discusses the practical threshold of 5,000 contacts that triggers the Safeguards Rule, and how firms can unintentionally exceed it through accumulated payroll records. They explore concrete steps to achieve compliance: adopting secure client portals (Lissio’s platform), integrating email, SMS, and document‑capture workflows, and establishing clear policies that keep communications within the core system. Real‑world anecdotes illustrate client resistance to new software, the need for waivers, and the benefits of centralized storage when a client loses access to other platforms. The hosts also highlight the cultural challenge of moving clients away from email, emphasizing training, “re‑training,” and using texting responsibly via a secure, firm‑controlled channel. Throughout, the tone remains conversational yet urgent, underscoring that non‑compliance poses both regulatory fines and existential business risk. The episode ends with a promise to continue the discussion in a second part.
Chapters
Welcome to Accountants LawPod, where accounting professionals and law firms converge, hosted by Linda Artesani, Sarah Prevost, and Steven Libhart.
Hello everybody, and welcome back to our podcast. And this week we have a very interesting topic. I kind of call it a dry topic. It's FTC compliance, but it's actually been kind of a buzzword amongst us accountants and bookkeepers. And we have a special guest with Chris Farrell, and he's going to tell us what he knows about that. So welcome, Chris. I guess we can dive right in because it is definitely a topic of intrigue.
And importance.
And importance.
We really— yeah, I'm excited. I'm excited to learn.
And Chris Farrell's from Lissio. And if you are watching on YouTube, we all have our Lissio shirts on.
I don't know.
And he's a dear friend of ours from a long time.
Love it. Well, thank you, Linda. Thank you, Sarah, for having me on.
Of course. We love having you on. We always have good conversation with you.
We do.
Yeah.
Love it.
Teach us. What is it that's coming? Like, or it is now, right?
It is. I think the FTC has weighed in. The Federal Trade Commission has said it's time, right? It's time to take care of personally identifiable information and client information, right? So a lot of people have been pretty lax. You've probably read about it in the Journal of Accountancy. You've heard about it through the IRS Publication 4557 and many other publications. You've heard it from the IRS Dirty Dozen, things to not do and to watch out for. So much client information has been in emails, so much client information has been in texts, so much client information is actually leaked out on the dark web. This is really, really bad stuff. Right? And what have we been doing as a profession for a long time? Probably a little bit of a head in the sand. I know you all aren't. You've taken security very seriously from jump.
Absolutely.
I hope that's paid off really well for you. But I think in general, when you think about where the profession has been, it's been same as last year, which is email's been in use and circulation for 30 years. People are saying my clients won't change. There's a lot of excuses around it. The FTC is saying, you know what? You have to move, right? And it makes sense. I think most clients are— have moved their banking entirely off of email, the relationships entirely inside of secure apps and so forth. It's been that way for the better part of a decade already. So when is the accounting profession going to follow suit and play ball with what everything else happening in the consumer space, right, has done? When is that going to happen? The FTC says it's probably not going to happen unless we start saying something, unless we start putting fines behind it. So here they come. Here they are. And that's more or less the world we're about to live in.
It's lofty fines too, right?
Heavy fines. It's heavy fines. I think the reality is if we all kind of look at it and say, look, the majority of the accounting profession is small firms, right? One person in the practice, 2 people in the practice, maybe 3, 4, or 5. That's really where the majority is. are probably thinking, hey, you know what, the chances of the FTC coming after me are pretty low. I think we would all agree with that. How could you enforce it across 200,000 firms just in the US? Seems unenforceable, doesn't it? I think there's this other reality though, which is there's a market force which is going to really get everybody in line. The market force is the threat is so real and has been so real and so pervasive for so long That the FTC and the IRS are saying, we're done fooling around, you have to do this. And they've been asking us politely every year. If you're— if you do taxes, they ask you for a PTIN renewal.
Mm-hmm.
It has you check a box saying you are protecting client information. People have been checking that. Some people, maybe the majority, we might argue, have been checking that blithely. Yeah, I'm doing that. I'm not doing that, but I'm just gonna check the box and move on. I think with that in the— in, you know, as, as kind of the backdrop, People will let their guard down a little bit. The market force that's going to correct it is going to be cyber insurance. Most firms have cyber insurance today. Most firms. But if you watch what's happened with cyber insurance, number one, cyber used to be the least expensive insurance option that you could get out of the big ones. Like, it was professional liability and so forth, more expensive. Cyber insurance, starting I think maybe a year or two ago, became the most expensive Part of business insurance for accountants. Cyber moved to number 1. The market forces, ransomware, all this stuff has pushed that to that point. It's not going to get any cheaper. The issue I think that people are having now is they're finding out that if they blindly check those boxes and aren't following what they say they're doing in order to get cyber insurance— Number 1, if they don't have that cyber insurance, they're not going to be able to get it. Big risk. Number 2, if they have cyber insurance and they aren't doing what they say they're doing, and they're not compliant with the FTC regulations and so forth, what's gonna happen? The insurance isn't gonna pay out. So premiums are being paid today by a lot of firms that are likely to be ignored. And we're already seeing— we're already seeing this in the insurance company's reviews. Oh, you got ransomware or a bunch of client information leaked out. But you weren't following the guidelines. Therefore, that's not our fault as an insurer. That's your fault as a business. You're on your own.
I guess is the change. So the change, it's been in effect, but the change is now you have to— you're beholden to the rule. And it's not just tax firms, it's everybody that's in the space, right? Like, that's offering services that For it. So just because you have the PTIN and you're doing it that way, it's not that you— it's for all, all of us doing any sort of accounting work, right?
Depends on how much PII you have, how much client information you have. You have a tiny, tiny bit, like if you're a one-person bookkeeper, bookkeeping for 12 clients, I think you, you have— you're not gonna have the FTC. I, I don't— quote me on this, but in my personal opinion, the FTC is not going to get involved. I think it's highly, highly unlikely. Yeah, remote, right? I think what's more likely to happen is if you choose to ignore all this stuff, right, really the real risk is the cyber insurance part and the threat to the business. Why go build a business up, get all these clients, and then be so wildly out of compliance by ignoring all the basic business standards?
Yeah.
That seems like an existential risk to the firm. So why take that risk on? But I think the FTC has regulations around it. I think the minimum standard is If you have contacts, I think it's 5,000 contacts. You have 5,000 contacts in your database, you have to comply with the FTC Safeguard Rule. If you do any tax returns, any at all, the standard is you must comply with 4557/FTC.
Sure.
Yeah.
It's not gonna apply to everybody, but I think we're looking at really this broad standard that everybody should take a look at.
Yeah. And we should all conform to it regardless. I mean, you could accumulate if you're a firm that's been in existence for a while, you could accumulate to that 5 and not realize that you've retained old data. It's like old files in the filing drawer.
And it also relates to a number of people, right? So if you have, let's say you do bookkeeping, you've been doing bookkeeping for firms and the average size of the, let's say you do restaurants. Restaurants get a lot of people going through payroll. You're gonna get a lot of people in a year. A 25-person restaurant might have 50 different employees just for that one restaurant over a couple of years.
Yeah.
Accumulate hundreds and hundreds of employees' worth of records underneath a single restaurant.
Yeah.
Right. And so you can sneakily get there. So I think the point there, though, is really, look, if, if you're worried about client data and you're worried about your fiduciary duty, The, you know, we're at the point now in the market where there's so much risk, there's so much risk that the largest government regulatory bodies are coming in and saying, pay attention. If you don't pay attention, there are repercussions. And the market force on the insurance side is doing the same thing.
And, you know, and as a business owner, and now we have quite a few employees now, more than we had a few years ago, you know, you have to be Hoping and making sure you put in workflows and processes with everybody revisiting this. We talked about this when it first— we first got notified about this change. We talked about the staff and they were like, well, what does that mean? Does that mean we can't? Because some of our clients like to get an email with their financial statements. Like, no, you have to make sure we stick to— we use Lissio, stick to inside the product, stick to where it's safe. And there should be no pushback. If there's pushback, now we have another way we can say, look, we're trying to keep your data safe. So it depends on what's on it. But I know with payroll and anything sensitive like that, you have to have a place to store and communicate with your client because you don't want— that was the reason why I went to Laseo was I didn't want too many people were emailing me the driver's license, everything I need, Social Security, they fill out the W-4, and I'd be getting this data set that was like, here you go, who wants to steal the data? And you don't wanna have that exposure and you don't wanna do that to your clients. You know, it would be awful if a client's data got stolen because it was in your hands. I would feel terrible about that. So, and, but when you get bigger, the larger the firm, now you're not the only one doing the work.
You have— You have, you have the innovative solution, Linda, right? You had the most innovative solution that we saw. You wanna tell everybody about that?
Well, when I told my— I had one client out of all of them when I made the switchover because it's hard to change software. And I said, this is what I'm doing now. And he's like, I don't want another app. I don't want more software. I'm not gonna do it. He said, I'm not gonna do it. And I told him, well, I'm not gonna hold the responsibility of taking care of your data. And you're telling me you want me to email you all this stuff. And I'm gonna push that responsibility on you. I want you to sign a waiver form. I'm gonna put it together for you. I didn't have one, but he didn't know that. And he was like, oh, oh, oh, I don't wanna sign a waiver. He did not wanna take that responsibility. It was okay to throw it in my lap. So You know, we ended up— he's actually really good at Licio too. He's like, everything's communicated nicely and everything's in there. And one client I had too, somehow he deleted his Google account and he had shared all these documents with me. And it was so funny because he's like, I deleted my entire Google and they can't get it back to me. And I'm like, well, we have everything stored here in Licio. You know, the files are here. He was so happy. It was like his original spreadsheets of all his back trust data. And he was like in heaven that we had it all because we asked for it. And he's like, oh my God, it's there? I said, yeah, it's not— it didn't get deleted. I don't know how he deleted his Google, nor do I wanna know.
Well, you had the story, which, I mean, we've all had it, where somebody kept getting fraudulent— you know, they had to close their bank account down and change their bank account. What the heck does this person do? Send an email.
Log it to the bank. After they logged it, they emailed it to me and I'm like—
But that's the— I think, Chris, that's the part that's very hard is you don't control the input. The in— you try as a firm owner, but you cannot do that.
It's hard to control everybody that has it in hand unless you firmly put processes in place, which we revisit. Like, this is what we do. This is company policy.
Yeah.
There's no wiggling off of that. You're gonna be in big trouble if you do something. I don't care how much the client wants it sent by email. No. And they get a notification, so they know it's there, and then they go back and they get it. It's just some people are like, I hate to say they're my age, they're old, and they just like their email, and they don't— they're the ones that are probably clicking on some website that's not right, that they get hacked in. You know, that's the typical person that would probably— I think of my husband, he would probably click on something that he's not supposed to. And then he'd be like, Linda, can you fix this? Because he'll have a virus on his computer. Same thing. You just wanna protect from all that. And so as far as FTC goes, yes, that's there. But also as a human and as a business owner, you just don't wanna expose your clients at all. I mean, there's ways to make sure they're secure.
I think, you know, for, as long as we know each other, you've always had such, you both have always had such a clear vision about whom you want to work with, right? You don't have this whole legacy client base that I think a lot of firms frankly are struggling with, particularly tax. You know, I've been serving this tax client for the last 30 years, 40 years. They're wonderful. We have a great relationship. I can't get them to move. So we have to understand, like, a lot of firms can't be purists around that.
Yeah.
And, you know, us for a long time as well, we came out saying, look, everybody should do this. Therefore, this is what we built. But I think we had to relax our stance as we came closer to the reality for a lot of firms, which is you're right. There's somebody who needs a lot of help. They aren't technology savvy. They can barely do email. Okay, how do we find a way to work within that bubble? And I think the reality is it's kind of like banking, right? When you work with your bank, banks do most of their transactions now through the secure website, through a mobile app. Most.
Yeah.
But they're not taking away the branch. They're not taking away, you know, their ways of serving us, right? What they've done is they've built a really attractive bridge to the future, but they're maintaining some, you know, one firm foot firmly in the past, right?
Mm-hmm.
So we think about that, it's like, oh, okay, most firms are gonna have to do something like that. So our approach has been like, we'll build the, we have the email integration, the SMS texting, right? So if your clients are doing that, We can continue to encourage them over to the right side. So we can, over time, build a bridge from where they are today to where you want them to be tomorrow. And it's been highly, highly successful with banks. Like, bank app adoption is the supermajority. Mobile banking is much more than web banking now. And did they ever twist our arms?
Nope.
No.
No, they offered it so we didn't have to go to the bank. That was the big thing. Like, oh my gosh, not having to go to the bank.
Well, now what's the deal? You make appointments to go into the bank depending on the level of what you are. So to your point that you brought up in the initial, consumer has been— the consumer side has been doing this for so long. The adoption of it on this side of the fence has been the slowest churn probably ever.
And you can retrain your clients. So every once in a while, they'll go back to email, and then I don't answer it. I wait till Friday. So if it happens during the week and they tried to email me on Friday, and then I take that email, which now we don't have to do, but I take that email and I send it back in Lissio. I answer them in Lissio. And then I'm like, oh, and I'll write right in there, I'm sorry, I don't monitor that email. I communicate with all the clients. I live in this software. For your security, and then it just retrains them, and then they get it and they get back in the groove of it. It's just laziness, basically. It's like, what's the fastest way, right?
And that's right, because everybody's texting too, right? I mean, I don't— you all don't have this problem, but somebody texts.
We do.
Attorneys text. A lot of attorneys.
So use Licio Texting, and when they text you something that you want to make sure is secure, you just send the Licio link back via text. But it's all coming from Licio Text with the Licio.
And not my phone number. them to have.
Speaking of phone numbers, Chris, you kinda said this, and Linda, you said, so I, I had this experience, and it's on the consumer side. I called into something. It recognized my phone number. It immediately drops me in through, okay, which service do you wanna, like, basically knew by my phone number what I wanted or potentially what I could want. And it was great. And then to the point where it was not great because it stayed still robo, stayed still, like, very friction-based. And I think what you're going to is, I'm happy to meet as a service provider to all of us, is you're looking at it through that lens of I'm happy to meet you in the middle somewhere because too much friction, it just becomes an angry and ugly circumstance with the client. You want some sort of flow that's a little bit more native and they'll eventually adopt it. I believe, is into a new space.
Because I think if you look at the whole problem here, like, you got the person who said, hey, I don't wanna use another system. I'm not gonna sign your waiver, so I'll use the system. What happened? The client's happy.
Right?
You have somebody working in Gmail, delete their Gmail. There's always these moments which are gonna move you to something like, okay, I'll try this. And once you tried electronic banking, we never went back. Right?
We never went back. Yeah.
Yeah.
It's the same thing. People are afraid of change. So there's gonna be a moment You know, where they have to sign something or find something or send a file that's too big for email. There's always a moment that spurs, you know, trial. Once you spur trial, they realize, oh my gosh, it's got Face ID or whatever. This is easier than what I was doing before. Then they're over the hump. So I think if you look at, like, texting, for example, within the context of the FTC, right? Mm-hmm. Texting within the context of FTC. So we're texting. Most firms who have 2, 3, 4 employees, The employees will start texting because the client is texting. Okay. What happens when that person loses their phone or worse? What happens when that person no longer works for the firm?
Yeah. You have no control.
They walk out of the door with a mobile phone full of PII and client information.
Yeah.
In what world is that good?
No world. Right?
We say, okay, look, the SMS has to— this is happening in practice with everybody. The SMS has to stay in the core system. It stays in the core system, and all of a sudden there's something like, hey, I need to send you my driver's license. Okay, great. You're gonna do that. This— you can send them a link from the same text message that puts them into the app with the scanner. Use this scanner. Yeah, yada yada. But you can do that in flow without having to toggle between systems.
Mhmm.
And just make it dead simple to do that. That is gonna, you know, I think, Change the security stance for firms, you know, dramatically.
Yeah.
In addition, it's addressing this core need, which is how many people get an email and ignore it? Everybody. And so what do people do? Well, they send another email. Okay. If that doesn't get answered, what do they do? Either they call, which takes a lot of time, or they send a text message from their personal phone, which opens up Pandora's box for Personal quality of life, right? But we know as accountants, we have to get their attention. Therefore, why don't we use texting the right way? So if we go to a hairstylist, if we go to our dentist, if we go— heck, if we go out to make a dinner reservation somewhere, what do they do? Mobile app notification and text reminder.
Oh, yeah.
Yeah.
Always. And even you shop right now. Can we add you? You'll get additional discount if you get Do you know what I mean? Like, yeah, texting you promotions. Well, at some point that's noise and I'm blocking or spamming or unsubscribing. But yeah.
But if it's from your accountant or somebody you trust professionally, exactly. Why don't you use a professional system for maintaining it? Because exactly putting it in a silo where, you know, you got employees, your employees can't see what's been texted to you. You can't see what's been texted to them. Now you've got this whole other channel You got to start to manage, which is, hey, did you do this? Or I need to get this to you. Or somebody texted you a document you need to get to your staff. You got to go onto your personal phone, download the document, somehow convert it to a PDF, get it. Like, it's just a— it's just big.
It's a cycle. You know what's interesting too is when you're, um—
Hi, LawPod listeners. Tiara here, the girl behind the scenes. We had so much fun with today's conversation that we Well, we just didn't want it to end. So we thought we'd split it up into a 2-parter. We hope you join us next week as we continue this great conversation.
