GLBA GUIDE
Pay stubs, tax returns, account statements, signed disclosures. GLBA does not care which product moved them; it cares whether they were encrypted, who could reach them, how long they persisted, and whether you can prove all three. This guide maps those obligations to the three ways documents actually move: email attachments, customer portals, and transport.
The Gramm-Leach-Bliley Act splits into a Privacy Rule (what you tell customers about data use) and a safeguards obligation (how you protect the data). Document sharing lives under safeguards, and the safeguards text depends on who regulates you.
Banks, thrifts, and credit unions answer to the Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 Appendix B and the parallel appendices for the FDIC, Federal Reserve, and OCC) and to NCUA Part 748 for credit unions, examined through the FFIEC Information Security Handbook. Non-bank financial institutions, including mortgage brokers, auto dealers that arrange financing, payday and consumer lenders, and fintechs, answer to the FTC Safeguards Rule at 16 CFR Part 314. The two regimes use different words and land on the same four requirements for a moving document.Two more obligations ride along: oversight of service providers that touch customer information (314.4(f) and the Guidelines' third-party provisions), and, since May 2024, FTC notification within 30 days of discovering a notification event affecting 500 or more consumers, which makes knowing exactly where every document went a reporting prerequisite rather than a nicety.
An attachment is encrypted in transit only if every relay between sender and recipient negotiates TLS, and most mail paths fail open: when negotiation fails the message is delivered anyway. That is hop-by-hop, not in transit. The attachment is then stored unencrypted in the sender's sent folder, the recipient's inbox, every archive, and every backup, which fails the at-rest clause and creates retention copies nobody is disposing of on a two-year clock. Nobody can say who opened it. Examiners write this up as unencrypted transmission of NPI, and it is among the most common findings in community bank and credit union IT exams.
A portal can satisfy encryption at rest and access logging on paper. It fails in adoption. Asking a borrower to create an account, set a password, and confirm an email to upload a pay stub produces an abandonment rate that lenders measure in the majority, after which the loan officer says "just email it to me." The compliant channel exists and the non-compliant one carries the volume. A portal also concentrates credentials: every customer account is a password to be phished, and the institution now governs a stored copy of every document for as long as the account lives.
A transport that satisfies the clause looks like this: the sender's system creates a one-time encrypted delivery for a named recipient; the recipient opens it from a notification with no account, password, or app; the document is encrypted from pickup to delivery and the encrypted container is destroyed once delivered, so nothing persists on a relay, in an inbox, or in a backup; and every pickup is logged per document with who, when, and from where. That is the Secure Digital Transport model, and it is the control, not a workaround. The practical walkthrough is in how to send sensitive documents without a portal.
Mapped to the clauses: encryption from pickup to delivery satisfies in transit and at rest with no fail-open hop; a delivery bound to one recipient, with optional identity verification at open, satisfies access control; destruction of the container after delivery means there is no stored copy to retain or dispose of; and the per-document access log is the monitoring evidence. For collection, the same transport runs in reverse so the borrower drops the document in without an account, which is where portals were losing them.
The transport described above is the layer under Botdoc's banking and lending products, including Spark and Connect for outbound and collected documents and SecureMFP for scanned documents that would otherwise leave the copier as an attachment. The institutions using them range from community banks and credit unions to large national lenders. Details by product are at Built on SDT; the API for building your own workflow is the SDT Engine.
Not as normally configured. GLBA requires encryption in transit and at rest and the ability to demonstrate access control and monitoring. Standard email encrypts hop by hop at best, stores the attachment unencrypted in multiple mailboxes and backups, and produces no record of who opened it. Encrypted email add-ons close the transit gap but still leave stored copies and usually push the recipient into a portal.
For non-bank financial institutions, 16 CFR 314.4 requires encryption of customer information in transit over external networks and at rest, access limited to authorized users, secure disposal within two years of last use absent a business need, and logging of user activity. Banks and credit unions meet the parallel requirements of the Interagency Guidelines and NCUA Part 748 under FFIEC examination.
No. The rule requires outcomes, encryption, access control, retention discipline, and audit evidence, not a portal. A portal is one way to reach those outcomes and it usually fails on adoption. A secure transport that delivers or collects a document without a recipient account reaches the same outcomes with no stored copy and no credential to protect.
Delivery or collection of a customer document in which the file is encrypted from pickup to delivery, bound to a named recipient, destroyed after delivery so no copy persists in transit systems, and logged per document. Secure Digital Transport is the category of technology built on exactly that model and runs under Botdoc's banking and lending products.
Yes. Any business significantly engaged in financial activities, including extending or arranging credit, is a financial institution under the FTC Safeguards Rule. Auto dealers that arrange financing and mortgage brokers are covered and have been subject to the full amended rule since June 2023.
This guide summarizes public regulations for educational purposes. It is not legal or compliance advice; confirm obligations with your counsel and your examiner.