Financial Services IT in San Antonio

Compliance Depth

Compliance That Survives an FFIEC Exam

Here’s a pattern we see across financial firms in San Antonio.

One person owns compliance. At a community bank it might be the information security officer. At a credit union it might be the operations VP. At a 30-person RIA it might be the CCO who also manages vendors and client onboarding. Either way, the firm’s entire regulatory posture depends on someone with 3 other jobs.

That’s not a criticism. It’s the reality of running a lean financial institution in a market dominated by giants like USAA and Frost.

Financial services IT that survives an exam means your technology environment produces the access controls, documentation, and audit trails your regulator expects, mapped to the framework that governs your firm type. Banks and credit unions answer to the FFIEC IT Examination Handbook and the GLBA 501(b) Interagency Guidelines Establishing Information Security Standards. Credit unions add NCUA Part 748. SEC-registered advisers and broker-dealers answer to Regulation S-P. CPA and tax practices, state-registered advisers, and mortgage companies answer to the FTC Safeguards Rule. We map to the one that applies to you, not a generic checklist. Our guide to FFIEC compliance for financial institutions covers the examination side in more depth.

The clocks got shorter. A bank must notify its primary federal regulator within 36 hours of determining that a qualifying computer-security incident occurred, and 7 TAC 3.24 makes a Texas state bank tell the Banking Commissioner on the same clock. A federally insured credit union gets 72 hours to report to the NCUA under 12 CFR 748.1(c), in force since September 2023. And since June 3, 2026, all SEC-registered advisers and broker-dealers, small firms included, must notify affected customers within 30 days under amended Regulation S-P, which also requires a written incident response program to detect, respond to, and recover from unauthorized access to customer information. Each clock assumes you can detect and document an incident fast. Most firms can’t, until they can.

Your IT Provider Sits Inside Every One of Those Clocks

Read the same rules from the vendor’s side and a pattern shows up. Each one reaches your IT provider.

The bank rule puts a duty on the bank service provider directly. When an incident disrupts covered services for 4 or more hours, or is likely to, the provider must alert the bank’s designated contact as soon as possible. Amended Reg S-P makes an adviser’s service providers report a breach of customer systems within 72 hours. The NCUA starts a credit union’s 72-hour clock when a third-party provider tells it about a compromise. And Texas Business and Commerce Code 521.053 tells any vendor holding someone else’s data to notify the owner immediately.

So the contract matters as much as the firewall. Ask whoever runs your IT, us included, to put 3 things in writing. A named contact who gets the call. A notice window measured in hours, not “promptly.” And who preserves the logs your examiner will ask for.

Uprite completed a SOC 2 Type 1 examination in 2023. That’s not a marketing line. Our controls have been independently audited against the Trust Services Criteria for security, availability, and confidentiality. When your examiner asks about your IT vendor’s security posture, there’s a report to hand them. Not a conversation to have.

We’ve done this work under the Safeguards Rule before. Our FTC Safeguards Rule remediation case study shows how a covered client closed its policy and documentation gaps and moved onto a recurring review cadence ahead of its next audit cycle.

What That Looks Like in Practice

One thing we notice. Most firms think they’re compliant because they check the boxes during exam season. Real compliance runs year-round. The difference shows up in the 6 weeks before your FFIEC exam, when either everything is already documented or your team is pulling all-nighters.

CPA and Tax Practices Carry a Federal Duty Too

Bexar County has 232 CPA offices averaging 13 people each, per 2025 BLS QCEW data. Any of them that prepares income tax returns is a financial institution under 16 CFR 314.2(h)(2)(viii) of the FTC Safeguards Rule, regardless of size, and the small-firm exception in 314.6 doesn’t waive the duty to notify the FTC. That means a written information security program, a named Qualified Individual, multi-factor authentication, and encryption. A notification event touching 500 or more consumers goes to the FTC within 30 days of discovery.

The IRS says the same thing on its own forms. Form W-12, the PTIN application, asks every paid preparer to acknowledge that a written information security plan is required, and IRS Publication 4557 lays out what belongs in it. The breach list proves it. CPA and tax practices filed 20 of the 122 financial-sector notices on the Texas Attorney General’s breach list in the 12 months of listings through October 2, 2026, including 1 from San Antonio. Our IT services for CPA firms in Texas cover the full program, run from the Radium Street office.