Small dealers hear "federal compliance" and picture a franchise store's compliance officer and a binder nobody reads. Here's the truth: if you arrange financing — even occasionally, even through one subprime lender — federal law treats you as a financial institution for several purposes, and three regimes apply to you at any size. None of them requires a compliance department. All of them require a written, honest, actually-followed process. Here they are, sized for a small store.
1. OFAC screening: the five-second check on every deal
The Treasury's Office of Foreign Assets Control maintains the SDN list — people and entities U.S. businesses are prohibited from transacting with. There is no small-business exemption and no minimum deal size: dealers should screen every buyer (and co-buyer) against the list before completing a transaction. In practice this is trivial — OFAC's free online search takes seconds, and most DMS, credit-pull and compliance platforms run it automatically with the credit application. The small-dealer failure mode isn't hitting a match (true matches are rare); it's having no record of ever checking. Fix: make the OFAC check part of every deal jacket — the screenshot or system log goes in the file. If you ever do get a potential match, don't improvise: verify it's a true match using OFAC's guidance, and call OFAC's hotline before proceeding.
2. The Red Flags Rule: your identity-theft radar
The FTC's Red Flags Rule requires creditors — which includes dealers who arrange or extend vehicle financing — to maintain a written Identity Theft Prevention Program: a document identifying the "red flags" you might see, what you do when you see one, and who's responsible. At small-dealer scale, the red flags are the ones you already half-know:
- ID that doesn't match the applicant — photo, age, signature, or an address that conflicts with the credit bureau file.
- Credit report alerts: fraud alerts, credit freezes, address discrepancies, a deceased indicator.
- Application behavior: the buyer who can't answer basic questions about their own credit history, documents that look altered, a "buyer" clearly being directed by someone else off to the side (also your straw-purchase tell).
Your program can be a few pages: the flags above, the response (stop, verify with additional documentation, decline if unresolved), an owner or manager named as responsible, and a note that you review it annually and train whoever touches credit apps. Boards of directors and annual reports scale down to "the owner approves it." What doesn't scale down is having it in writing — in an FTC or state exam, the unwritten program is the nonexistent program.
3. The Safeguards Rule: protecting customer data like the financial institution you legally are
The FTC's revised Safeguards Rule — fully in force since mid-2023 — requires dealers who handle consumer financial information (credit applications!) to run a written information security program. The full rule has real teeth: a designated qualified individual responsible for the program, a written risk assessment, access controls, encryption of customer data at rest and in transit, multi-factor authentication for anyone accessing customer information systems, vendor oversight, an incident response plan, and periodic reporting to ownership. There's partial relief for very small operations: some written-plan elements are relaxed for businesses maintaining information on fewer than 5,000 consumers — but the core security requirements still apply, and a dealer doing even modest volume crosses 5,000 records faster than you'd think. Also note: the FTC added a breach notification requirement — significant breaches of unencrypted customer data must be reported to the FTC. Small-dealer translation: credit apps never live in email inboxes or desk drawers; your DMS and lender portals get MFA turned on today; old paper files get locked or shredded on a schedule; one named person owns all of it in writing.
The bonus everyone forgets: Form 8300
Take more than $10,000 in cash (including certain cash equivalents, and including related installments that aggregate over $10,000) on a deal, and you must file IRS/FinCEN Form 8300 within 15 days and notify the customer annually. Structuring — coaching a buyer to split payments to stay under the threshold — is itself a crime. Cash-heavy independent and BHPH dealers: this is the federal rule most likely to actually hurt you, because the filings are easy to check against your deal log after the fact.
The one-afternoon compliance setup
- Write the Red Flags program (a few pages) and the Safeguards program (name the qualified individual, do the risk assessment honestly).
- Turn on MFA everywhere customer data lives; encrypt or lock the rest.
- Add two lines to your deal checklist: OFAC check logged; cash tracked against the 8300 threshold.
- Train the team for thirty minutes; note the date. Repeat yearly.
That's the whole burden at small scale — an afternoon of setup and a habit. The dealers who get hurt are almost never the ones with imperfect programs; they're the ones with no paper at all.
Want to see this working on your own inventory? UCallNow builds AI sales agents, BDC teams, Facebook Marketplace auto-posting and dealer websites for dealerships across the United States — in English and Spanish. Try SOPHIA live or see every solution and price.