The finance and insurance office is where a dealership's revenue, customer data and regulatory exposure all meet. A single deal touches advertising rules, credit and disclosure law, data security requirements, cash reporting and state dealer statutes. Most F&I problems are not the result of one bad actor; they come from inconsistent processes that let small shortcuts become routine. This guide outlines the main compliance areas, a practical self-audit, and where insurance does and does not help.
The regulatory landscape in 2026
Franchised and independent dealers are primarily overseen by the Federal Trade Commission and state attorneys general, along with state dealer licensing agencies. Two developments shape the current environment:
- The CARS Rule was vacated. The FTC's Combating Auto Retail Scams (CARS) Rule never took effect. On January 27, 2025, the U.S. Court of Appeals for the Fifth Circuit vacated it, holding that the FTC failed to follow its own rulemaking procedures by not issuing an advance notice of proposed rulemaking.
- Enforcement continued anyway. In March 2026 the FTC sent warning letters to 97 auto dealerships about price advertising, and the recipients were made public in May 2026. The practices flagged included advertised prices that leave out required fees, prices based on rebates not available to all buyers, undisclosed down payment requirements, prices that depend on dealer financing, required add-ons that inflate the final price, and advertising vehicles that are unavailable.
State enforcement has also been active. Reported examples include a joint FTC and Maryland action that produced $3.1 million in penalties and restitution from a dealer that added mandatory fees and required dealer financing, and multi-million-dollar settlements in New York and Illinois over unlawful fees and bait-and-switch marketing. The vacated rule did not change the underlying law: deceptive and unfair practices remain prohibited under the FTC Act and state consumer protection statutes.
Pricing, fees and add-on products
Most F&I enforcement comes back to whether the customer understood what they were paying for and agreed to it. Practical controls:
- Advertised prices match what a typical buyer can actually pay, with required fees included or clearly disclosed.
- Optional products (service contracts, GAP, appearance protection, theft deterrent) are presented as optional, priced separately, and declined products are documented on a menu the customer signs.
- Pre-installed add-ons are not represented as mandatory unless they truly cannot be removed, and the pricing is disclosed before the customer commits.
- Payment quotes are not "packed" with products the customer has not chosen.
- Rate markups and product pricing follow a written policy applied consistently across customers.
Washington documentary service fees. Under RCW 46.70.180, a Washington dealer may charge an optional documentary service fee of up to $200 per sale or lease. It must be disclosed in writing before the agreement is signed, with a conspicuous statement that the fee is negotiable, listed separately from the price and other charges, and never described as required by the state. Advertisements must disclose that a fee of up to $200 may be added. Other states set different limits or none, so check each state where you sell.
Customer data: the FTC Safeguards Rule
Dealers that arrange financing or leasing hold exactly the information identity thieves want: Social Security numbers, income, bank details and credit reports. The FTC's Safeguards Rule, which applies to non-bank financial institutions under its jurisdiction, requires a written information security program. Key elements include:
| Requirement | What it means in practice |
|---|---|
| Qualified Individual | One named person, employee or outside provider, oversees the program. |
| Written risk assessment | Identify where customer information lives (DMS, CRM, email, paper deal jackets) and the risks to it. |
| Encryption and multi-factor authentication | Encrypt customer information on your systems and in transit; require MFA for anyone accessing it. |
| Service provider oversight | Contracts with vendors spell out security expectations, and you monitor them. |
| Annual written report | The Qualified Individual reports in writing at least annually to the board or owners. |
| FTC breach notification | Since May 13, 2024, notify the FTC as soon as possible and no later than 30 days after discovering unauthorized acquisition of unencrypted information involving at least 500 consumers. |
Businesses that maintain information on fewer than 5,000 consumers are exempt from certain provisions, but not from the rule as a whole. For practical steps, see cyber security essentials for small business and our guide to business email compromise, a common way funding and payoff wires are diverted.
Cash reporting and other back-office rules
Dealers that receive more than $10,000 in cash in one transaction, or in related transactions, must file IRS Form 8300 within 15 days. Multiple payments toward a single purchase count together. Beginning with 2024, a business that is required to file at least 10 other information returns in a calendar year must e-file Form 8300. Records must be kept for five years. Train desk managers and cashiers to recognize structuring, where a customer splits payments to stay under the threshold, and to escalate rather than advise the customer.
Other areas a complete F&I compliance program addresses include fair lending and adverse action notices, credit disclosures, identity theft red flags, sanctions screening, and state rules on spot delivery and rewritten contracts. Your compliance counsel or a dealer compliance vendor can map these to your specific store.
A quarterly deal jacket self-audit
A simple audit catches drift before a regulator or plaintiff does. Pull a random sample of deals each quarter, from each F&I manager, and check:
- Signed product menu showing offered, accepted and declined products.
- Advertised price (if the vehicle was advertised) compared with the buyer's order.
- Doc fee and other fees disclosed as required by state law.
- Credit application, privacy notice and any required credit disclosures present and consistent.
- Identity verification and red flag review documented.
- Cash receipts reconciled, with Form 8300 filed when required.
- Cancellation refunds on products processed correctly when a contract is paid off early or a product is cancelled.
Track findings by manager and by issue. Patterns matter more than any single deal.
Where insurance responds, and where it does not
F&I exposures are mostly financial and regulatory, which means a general liability policy, built for bodily injury and property damage, generally will not respond. Coverage depends on the specific forms you carry.
Dealers errors and omissions
Designed for economic-loss claims from customers, such as alleged misrepresentation, title problems or paperwork errors. Coverage for statutory violations and regulatory actions varies widely by form.
Cyber liability
Can cover breach response, notification costs, forensic investigation, and liability for compromised customer data, depending on the policy.
Crime coverage
Addresses employee theft and, if endorsed, funds transfer fraud and social engineering losses. These are often sublimited or excluded unless specifically added.
Employment practices liability
Responds to employee claims such as wrongful termination or pay disputes, which often surface when F&I staff are disciplined.
Fines, penalties, restitution and disgorgement are frequently excluded or uninsurable under state law. A strong compliance program is the main protection; insurance is the backstop for defense costs and covered claims. See cyber liability insurance, employee theft prevention, employment practices liability, and our overview of auto dealership insurance.
When to call your broker
Call us if you receive an FTC warning letter, a civil investigative demand, an attorney general inquiry or a class action demand; if you suspect a data breach; or if you add a buy-here-pay-here operation or new product lines in F&I. Notify your carriers promptly, since late notice can jeopardize coverage under claims-made policies. We can also review whether your E&O and cyber policies fit the way your store actually sells.
This article is general information, not legal advice. Consult your attorney or compliance advisor about your specific obligations.
Sources
- Consumer Financial Services Law Monitor — Fifth Circuit vacates FTC's CARS Rule
- Crowell & Moring — Auto dealers: FTC warning letters signal renewed federal scrutiny
- Federal Trade Commission — FTC Safeguards Rule: What your business needs to know
- Hudson Cook — FTC finalizes notification event amendment to Safeguards Rule
- IRS — E-file Form 8300, reporting of large cash transactions
- Washington State Legislature — RCW 46.70.180, unlawful acts and practices (documentary service fee)