How GLBA applies when AI agents handle customer financial data: Bank guidelines, FTC Safeguards Rule, Reg P, logging and breach notice requirements.
The Gramm-Leach-Bliley Act (GLBA) says nothing about AI agents, and it does not need to. Its safeguards apply to customer information however it is handled, so a software agent that reads an account record falls inside the same program as an employee or a vendor.
This guide is for compliance, security and operations leaders at banks and non-bank lenders. It sets out which GLBA rules apply to which institution and what each requires that matters for an agent. We checked each rule against the eCFR in October 2026. It is general information, and questions that depend on your facts belong with counsel.
GLBA has a safeguards side and a privacy side, and the regulator depends on the kind of institution.
Rule | Who it covers | What it governs |
|---|---|---|
Interagency Guidelines Establishing Information Security Standards (OCC banks: 12 CFR part 30, appendix B; the Federal Reserve and FDIC publish parallel text) | Banks and savings associations | Written security program, risk assessment, controls, service provider oversight, board reporting |
FTC Safeguards Rule, 16 CFR part 314 | Institutions under FTC jurisdiction, such as non-bank lenders | Same subjects, more prescriptive, plus FTC notice of certain breaches |
Regulation P, 12 CFR part 1016 | Institutions within the CFPB's GLBA rulemaking authority | Privacy notices, opt-outs and limits on sharing nonpublic personal information |
The privacy side covers individuals who obtain financial products for personal, family or household purposes. Reg P does not apply to information about companies or about individuals who obtain products for business, commercial or agricultural purposes (12 CFR 1016.1(b)). Check which of your products fall under it before you scope an agent's data access.
Part 314 has a size carve-out. The written risk assessment, penetration testing and scans, written incident response plan and board report (314.4(b)(1), (d)(2), (h), (i)) do not apply to institutions holding information on fewer than 5,000 consumers (314.6).
Neither the bank guidelines nor the FTC rule defines an AI agent. The FTC rule defines an "authorized user" as any employee, contractor, agent, customer or other person authorized to access your information systems or data (16 CFR 314.2). That "agent" is not written about AI, but the safeguards attach to authorization. In our reading, an AI agent your systems authorize to read customer information is subject to the same controls.
The table maps the controls that matter most for an agent to their source.
Control for an AI agent | FTC Safeguards Rule | Interagency Guidelines (OCC) |
|---|---|---|
Limit access to what the job needs | 314.4(c)(1): authenticate users, limit access to what they need | III.C.1.a: access controls on customer information systems |
Strong authentication | 314.4(c)(5): multifactor authentication, unless the Qualified Individual approves an equivalent in writing | No separate item; falls under access controls, III.C.1.a |
Encrypt customer information | 314.4(c)(3): in transit over external networks and at rest | III.C.1.c: encryption, where appropriate |
Log and monitor | 314.4(c)(8): monitor and log authorized users' activity | III.C.1.f: monitoring systems to detect attacks and intrusions |
Control changes | 314.4(c)(7): change management procedures | III.C.1.d: system modifications consistent with the security program |
Dispose of data | 314.4(c)(6): secure disposal, generally within two years of last use | III.C.4: disposal measures |
Oversee providers | 314.4(f): select, contract, assess periodically | III.D: due diligence, contract, monitoring |
The vendor side is covered by the interagency third-party guidance, which applies to any AI vendor that touches customer data.
Treat the agent as a privileged user with its own identity.
The bank guidelines tell banks to consider dual control and segregation of duties for people with access to customer information (III.C.1.e). An agent that can both draft and release an action should not exist. Our posts on AI agent identity management and AI agent access control cover this in depth.
Send the model the minimum. Mask account numbers, Social Security numbers and credentials where the task does not need them, and decide how long prompts, outputs and transcripts are kept. The Safeguards Rule's disposal and retention review requirements are the nearest written hooks (314.4(c)(6)).
The contract carries most of the legal weight. Under Reg P, an institution may give nonpublic personal information to a nonaffiliated third party to perform services on its behalf without offering an opt-out only if it has provided the initial notice and signed a contract that prohibits the third party from disclosing or using the information other than to carry out the purposes for which it was disclosed (12 CFR 1016.13). If a vendor's terms let it use customer data to train its own models, that may fall outside the contract the exception describes. This is our reading, so put the question to counsel before you sign.
Record what the agent read, which tools it called, what it produced and who approved. Supplement A to appendix B says that if an institution can tell from its logs precisely which customers' information was improperly accessed, it may limit notification to those customers. Without logs, it may have to notify a whole group.
Notice duties differ by institution.
The FTC rule treats an event as discovered on the first day it is known to any employee, officer or other agent, other than the person committing the breach. Whether software counts is unsettled, so route any agent-detected anomaly to a named person at once.
Reg P requires an initial privacy notice when a customer relationship starts (1016.4) and an annual notice, unless the 1016.5(e) exception applies. It applies if you share nonpublic personal information with nonaffiliated parties only under the listed exceptions and have not changed your disclosure practices.
For an agent, the rule is practical. It must not disclose nonpublic personal information to a third party outside those exceptions, and its instructions should say which disclosures are permitted. If a change to its data flows changes your practices, your notice may need to change first.
Each Zamp AI employee runs one Agent Operating Procedure (AOP). For a role that handles customer information, the AOP would list the sources of truth the agent may read, the fields it may use, approval limits and escalation paths. The agent has its own identity with least-privilege access, so reading an account record does not carry rights to anything else. In the AOP we would also write that the agent may not disclose information to a third party or contact a customer outside the steps it names.
A case goes to Needs Attention when the agent cannot resolve it within scope, such as a request that needs data outside its permissions or an unfamiliar pattern, and a person receives it with the context assembled. Before a case closes, the PEV loop validates the agent's output, and the AOP is where we would put the checks a privacy officer cares about.
Every action is logged with its input, sources, result, approval state and correction history. In a biopharma procurement deployment, the agent wrote its reasoning inside the customer's own system of record, SAP Ariba. For GLBA, that points to the case system your examiners already read. See our trust and security page.
A reviewer's correction becomes an AOP change on a branch, tested against evals including a golden set, then reviewed and merged. That is the change history behind the "control changes" row above.
Banks usually choose BYOC or on-premises so customer data stays in infrastructure they already control, per our deployment models guide. We have not published encryption, retention or redaction settings here, so request them in diligence.
List every agent or AI tool that can read customer information. For each, confirm which GLBA rule governs it, name its identity, and check that its logs would let you size an incident. Then compare vendor contracts with Reg P's service provider language and your provider oversight rules. For the wider control set, see how to govern AI agents.
