# License financial data to AI: rules to check first > Trying to sell financial data to AI? Licensing it meets the FTC Safeguards Rule, Regulation P and DOJ's 10,000-person rule. Troveo lists ledgers and invoices. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-financial-data-to-ai Published: 2026-07-30 Updated: 2026-10-14 ## The short answer Financial data for AI comes with federal rules. Troveo lists ledgers, invoices and QuickBooks, and micro1's data partnership page lists reconciliations. The FTC Safeguards Rule lists accountants and tax preparers. Regulation P requires notice and opt-out. DOJ counts de-identified financial data on 10,000+ US persons. Counsel decides which applies. Financial records come with specific federal rules. This page maps the rules I found. Counsel gives the answer. ## Which companies name finance data? Two companies name finance data: - [Troveo's page](https://www.troveo.ai/business-data) lists a finance and operations group of QuickBooks, Stripe, NetSuite, Pigment and Shopify. It names ledgers and invoices as data types. - [micro1](https://www.micro1.ai/data-partnerships) lists financial processes and reconciliations. Both are self-description. None shows a price for finance data alone. A [micro1](/buyers/micro1) referral partner said in a micro1 video that a New York loans company took part. She said it closed in two to three weeks (self-reported, about 8:44). The company is unnamed and the story can't be checked. The video discusses no consent or lender-specific rule. So the rules below still apply. ## Who counts as a financial institution? The FTC Safeguards Rule, [16 CFR 314.2](https://www.law.cornell.edu/cfr/text/16/314.2), defines a financial institution as any institution whose business is an activity that is financial in nature. Its examples include: - A tax preparation service. - An investment advisory company. - A mortgage broker. - A credit counseling service. - A real estate settlement provider. The reach is wider than banks. My reading is that a company's own books and a client's account data raise different questions. That framing is not a cited rule. ## What do Regulation P and the DOJ rule say? Regulation P, [12 CFR 1016.10](https://www.law.cornell.edu/cfr/text/12/1016.10), bars a financial institution from disclosing nonpublic personal information to a nonaffiliated third party. It needs notice, an opt-out notice and a reasonable time to opt out first. [Can I license health or financial client data to AI](/answers/can-i-sell-health-or-financial-client-data-to-ai) reads the text. DOJ's Data Security Program, [28 CFR Part 202](https://www.law.cornell.edu/cfr/text/28/202.205), sets a bulk threshold. The threshold is personal financial data on more than 10,000 US persons. The data counts, per [section 202.206](https://www.law.cornell.edu/cfr/text/28/202.206), even if it is anonymized, pseudonymized, de-identified or encrypted. See [the DOJ bulk data rule](/answers/does-the-doj-bulk-data-rule-apply-to-selling-company-data). ## What about records a firm must keep? [17 CFR 240.17a-4(b)(4)](https://www.law.cornell.edu/cfr/text/17/240.17a-4) requires a broker-dealer to preserve originals of communications received and copies of communications sent that relate to its business. The retention period is three years. The first two are in an easily accessible place. A duty to keep records and licensing them are separate questions. Counsel answers the second. ## What can you gather first? List the finance tools. Note whether any hold clients' account details. List which notices clients received. The [rights check](/rights-check) and the [risk map](/risks) follow the same order. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three rules that can touch financial records: Regulation P (Notice, then opt-out), DOJ bulk rule (emphasized: Counts de-identified data, 10,000 US persons), SEC 17a-4 (Keep three years). The DOJ rule is emphasized because its thresholds count financial data even when it is de-identified. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) ยท [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's page](https://www.troveo.ai/business-data) - [micro1](https://www.micro1.ai/data-partnerships) - [16 CFR 314.2](https://www.law.cornell.edu/cfr/text/16/314.2) - [12 CFR 1016.10](https://www.law.cornell.edu/cfr/text/12/1016.10) - [28 CFR Part 202](https://www.law.cornell.edu/cfr/text/28/202.205) - [section 202.206](https://www.law.cornell.edu/cfr/text/28/202.206) - [17 CFR 240.17a-4(b)(4)](https://www.law.cornell.edu/cfr/text/17/240.17a-4)