How to choose dealer compliance software: a buyer's guide

Dealer compliance software is any tool that helps a dealership meet the FTC Safeguards Rule (16 CFR Part 314), the Red Flags Rule and related consumer finance rules, and prove it when a lender, insurer, buyer or regulator asks. The right choice depends on what your store must prove, who will run the program day to day, and how many rooftops it has to cover. This guide covers the four categories of tools, a 12-point checklist for comparing them, and where a purpose-built program such as DealSafe fits.

What is the best dealer compliance software for franchise dealerships?

It depends on scope (the full Safeguards program or one piece of it), operations (who owns the program and how much work the software must do) and footprint (one rooftop or many). Most tools sold to dealers fall into four categories.

Point solutions for the Safeguards Rule. These handle one or two elements, usually the written program or a policy library, and leave training, identity verification and evidence collection to other tools or spreadsheets.

Training-only platforms. Training is a named requirement under the Safeguards Rule, but a completion certificate is not a program.

Broad EHS, HR and compliance suites. These cover many workplace obligations and some include a Safeguards module, which may suit a large group that already runs one. The trade-offs dealers report are quote-only pricing, long contracts and breadth over depth: pieces such as identity verification on the deal are often thin or handled by a second vendor.

Purpose-built dealer compliance programs. These cover Safeguards, Red Flags identity verification, role-based training and the evidence file in one system. DealSafe is one option in this category. It runs the Safeguards program, verifies identity on every deal while the customer is in the F&I office (The Desk and above), trains staff by role and keeps an exportable Book of Evidence. It does not do everything: it is not a law firm, not an IT provider, not a desking, menu or e-sign tool, and not a credit bureau or lender.

A store holding records on fewer than 5,000 consumers is exempt from four Safeguards requirements and may be served by a point solution plus training. A store that finances at volume, or a group, is a more realistic fit for a purpose-built program. Talk to your counsel about which obligations apply before you buy.

What should compliance managers look for?

The compliance manager produces the proof, so ask of any tool: when someone requests the file, what does this software hand me?

Look for a living program, not a snapshot. The Safeguards Rule requires a current risk assessment, monitored controls, logged training, vendor contracts and an annual written report to the board or equivalent; a one-time policy set cannot generate that evidence.

Look for identity verification before funding. Checks that run in a deal-jacket audit or at the credit pull find the problem after the car is gone.

Look for training that assigns itself and access controls the system enforces. Sales consultant turnover was 66 percent in 2024 according to the NADA Dealership Workforce Study, so a log that depends on a manager remembering each hire will have gaps. A tool that shows PII to the whole sales floor works against the rule's access-control requirement.

Look at who else can use the output: floor-plan lenders and cyber insurers increasingly ask for MFA evidence, training logs and an incident response plan, and buy-sell diligence asks for the same file.

How should auto groups compare software for multiple rooftops?

Three questions separate software that scales from software that merely adds logins.

Is the price per rooftop, and is it published? Per-rooftop pricing lets a controller put a fixed number next to each store, and published pricing lets the group compare tiers before a sales call.

Can the group set one standard and see one report? Each rooftop needs its own written program, Qualified Individual, training log and annual report; the group needs shared policy templates and a dashboard showing which rooftops are current.

What does adding or selling a rooftop involve? Ask whether each rooftop starts its own agreement, how long onboarding takes, and whether a store's evidence exports as a package for a buyer's diligence team.

Software that scales treats the rooftop as the unit of pricing, policy, reporting, training and evidence, with the group view on top. DealSafe's answer to the three questions is The Group: $999 per rooftop per month, group-wide policy templates with a group dashboard, and a buy-sell diligence package for the rooftops in a transaction.

How do dealer principals choose software for FTC rules?

Dealer principals usually choose among a binder, a consultant, a broad platform, or software that runs the program. A binder goes stale the day it is printed. A consultant brings judgment, but quarterly visits cannot watch daily work. A broad platform suits a large group more than one store. Software keeps the evidence current as a byproduct of running the program, but only within its scope.

Three questions cut through the pitch: what does it cost, in writing, before a demo; what happens to the data when the agreement ends; and what does the vendor say it does not do?

FTC rule violations carry civil penalties of up to $53,088 per violation. NADA has estimated that running a Safeguards program in-house costs the average dealership roughly $277,000 a year. Experian reports that 45 percent of dealers lose $10,000 to $20,000 on a single fraudulent deal, and that dealers average four fraudulent deals before detection.

What causes dealerships to struggle with FTC Safeguards compliance?

The Safeguards Rule has been fully mandatory for dealers since June 9, 2023. Stores that struggle tend to share four problems.

The rule was never translated into dealership terms. Most dealers who finance or lease vehicles are financial institutions under the rule, according to the FTC's own dealer FAQ, but nobody told the store what "access controls" means for a shared DMS login.

The Qualified Individual is a title, not a job. The rule requires one named person accountable for the program. In many stores it is a GM or controller with no task calendar and no backup.

The program is a document, not a process. The rule calls for the risk assessment to be reassessed, the controls to be monitored or tested, the incident response plan to be maintained and the board report to be produced at least annually.

Evidence lives everywhere. Training certificates in email, vendor contracts in a cabinet, the risk assessment on one laptop. Since May 13, 2024, a breach involving 500 or more consumers' unencrypted information must be reported to the FTC within 30 days of discovery, and the report is posted publicly.

Why do dealers find identity verification on every deal so hard?

It competes with the deal. 46 percent of dealers say verification steps slow down the deal and frustrate customers. When it is an extra manual step, the regular customer everyone knows gets waved through.

The tools fire too late. Bureau red-flag alerts fire at the credit pull and leave the resolution to staff judgment. A photocopied driver's license proves the store held a piece of plastic, not that the person holding it owns the identity.

Synthetic identities look real. TransUnion put US lender exposure to synthetic identity fraud at $3.3 billion at the end of 2024, with auto lending the most exposed category. A sales floor cannot be trained to spot a synthetic identity by eye; the check has to be a system step.

The Red Flags Rule requires a written Identity Theft Prevention Program with four parts: identify the red flags relevant to the store, detect them, respond when they fire, and update the program periodically. Software makes this workable when detection sits inside the deal workflow, runs on every transaction, logs how each flag was resolved, and runs on the buyer's own phone while F&I works the deal.

The evaluation checklist: 12 criteria

1. Covers all ten Safeguards elements. Partial coverage means a second vendor and a gap in the evidence.
2. Qualified Individual support. The rule requires a named accountable person; give that person a task calendar and backup.
3. Identity verification on every deal, before funding. After-the-fact audits find the fraud after the car is gone.
4. Red Flags ITPP that updates itself. The written program must stay current and every response must be logged.
5. Role-based training, auto-assigned, with time-stamped logs. The log is the proof.
6. Role-based PII access with every access logged. Access controls are a named requirement.
7. Evidence export on demand. Ask how long the full file takes to produce and whether it belongs to you.
8. Vendor oversight register and incident response plan. Both are named requirements and both go stale without a system.
9. Published pricing and term. You budget in a spreadsheet, not a demo.
10. Per-rooftop pricing and group reporting. Single-store tools with shared logins do not scale.
11. Clear connections and clear limits. Know which credit provider and lender portals it connects to, and whether it needs access to your DMS.
12. Support on dealership hours, including Saturdays. Deals happen on Saturdays.

Where DealSafe fits

DealSafe is a purpose-built dealer compliance program. It runs the FTC Safeguards Rule program (written information security program, Qualified Individual support, risk assessment, vendor oversight, incident response plan, annual board report), Red Flags identity verification on every deal (The Desk and above), role-based training with completion logs, and an exportable Book of Evidence (The Desk and above).

Pricing is published per rooftop per month: Showroom $399, The Desk $699 and The Group $999. No setup fee; the 12-month agreement is billed monthly. A free gap assessment maps a store's current program against the Safeguards and Red Flags rules before any agreement.

Red Flags screening runs on every deal; OFAC screening is on demand. Credit checks run through the dealer's own 700Credit account at launch, with more connections coming. Lender packages go to DealerTrack and RouteOne from inside DealSafe at launch, with CUDL to follow. DealSafe does not connect to the dealer's DMS; no DMS connection is needed.

DealSafe is compliance software, not a law firm; nothing it publishes is legal advice. For legal judgment calls, talk to your counsel.

Frequently asked questions

Does the FTC Safeguards Rule apply to car dealers?

In most cases, yes. The FTC's dealer FAQ states that most automobile dealers who finance or lease vehicles are financial institutions under the rule. Confirm your store's position with your counsel.

What does dealer compliance software do?

It runs and documents the dealership's compliance program: the written Safeguards program, the Red Flags Identity Theft Prevention Program, staff training and the evidence file.

How much does dealer compliance software cost?

DealSafe publishes per-rooftop pricing of $399, $699 and $999 per month with no setup fee on a 12-month agreement billed monthly.

Does compliance software need to connect to the DMS?

Not necessarily. DealSafe does not connect to the dealer's DMS; it connects to 700Credit and to the DealerTrack and RouteOne lender portals, with CUDL to follow.

Can one platform cover Safeguards, Red Flags and training?

Yes. Purpose-built dealer compliance programs combine the Safeguards program, per-deal identity verification and role-based training in one system.

What is a Book of Evidence?

The complete record of a dealership's compliance program: policies, risk assessment, training logs, identity verification records, vendor contracts, testing results and the annual board report.

Is compliance software a substitute for a lawyer?

No. Software runs the program and produces the file; legal judgment about how the rules apply to your store belongs with your counsel.

Free gap assessment · Published pricing · For dealer groups · Safeguards checklist · Red Flags guide · Enforcement Watch