Every other building we clean treats janitorial as a facilities line item. A bank or credit union cannot, and the reason is written into federal regulation.
If a cleaning crew has after-hours access to your branch, that company is not a vendor in the ordinary sense. It is a service provider — a defined regulatory category — and your institution is accountable for it under the same information security program that governs your core processor.
Most cleaning companies do not know this. Most branch managers have never been told it. And it changes what the procurement conversation should be about.
The definition that catches a cleaning company
The FTC Safeguards Rule, which implements the Gramm-Leach-Bliley Act, defines the term at 16 CFR 314.2(r). A service provider is:
“any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution that is subject to this part.”
Read the clause in bold. The rule does not require that a vendor handle your data. It is enough that the vendor is permitted access to it. A cleaning crew alone in a branch at nine in the evening, with an alarm code and a key, is permitted access to everything in that building.
And what counts as customer information is broader than most people assume. Section 314.2(d) defines it as:
“any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of you or your affiliates.”
Whether in paper. Which means the loan application left in a printer tray, the note on a personal banker’s desk, and the contents of a teller’s wastebasket are all customer information in the regulatory sense — and all of them are within arm’s reach of a cleaning crew.
The rule is also explicit that this is not purely a digital obligation. Section 314.2(i) defines an information security program as:
“the administrative, technical, or physical safeguards you use to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information.”
Physical safeguards. Disposal. Section 314.1(a) requires “reasonable administrative, technical, and physical safeguards,” and 314.3(b)(2) requires the program to “protect against any anticipated threats or hazards to the security or integrity of such information.”
Put those four definitions together and the conclusion is unavoidable. A janitorial contractor with after-hours branch access falls inside the institution’s information security program, which is why §314.4(f) obliges financial institutions to take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards, to require those safeguards by contract, and to periodically assess the provider based on the risk it presents.
Not “should.” Obliges.
For credit unions, the bar is written differently and sits in the same place
Federally insured credit unions sit under NCUA rather than the FTC rule — 314.1(b) covers only “non-federally insured credit unions,” and the rest fall under 12 CFR Part 748. The obligations arrive by a different route and land in the same spot.
Section 748.0(a): “Each federally insured credit union will develop a written security program within 90 days of the effective date of insurance.”
That program must be designed to, among other things:
748.0(b)(1): “Protect each credit union office from robberies, burglaries, larcenies, and embezzlement.”
748.0(b)(2): “Ensure the security and confidentiality of member records, protect against the anticipated threats or hazards to the security or integrity of such records, and protect against unauthorized access to or use of such records that could result in substantial harm or serious inconvenience to a member.”
748.0(b)(4): “Assist in the identification of persons who commit or attempt such actions and crimes.”
That fourth objective is worth pausing on, because it is the regulatory reason access logs matter. A credit union is required to have a program that helps identify who was in the building. If your cleaning contractor cannot tell you, by name, which individuals were inside branch 7 last Tuesday night, your program is weaker than the rule contemplates.
Appendix A to Part 748 — the Guidelines for Safeguarding Member Information — then uses almost exactly the FTC’s language at I.B.2.f, defining a service provider as “any person or entity that maintains, processes, or otherwise is permitted access to member information through its provision of services directly to the credit union.” Member information is likewise defined as records “whether in paper, electronic, or other form.” And II.A requires a program of “administrative, technical, and physical safeguards appropriate to the size and complexity of the credit union and the nature and scope of its activities.”
The Appendix’s section III.D is headed “Oversee Service Provider Arrangements,” and requires credit unions to exercise due diligence in selecting service providers, to require appropriate measures by contract, and — where the risk assessment indicates it — to monitor them to confirm they have met those obligations.
The wastebasket is a compliance boundary
Now the part that nobody writes about, and the single most useful thing in this piece.
The FTC Disposal Rule, 16 CFR Part 682, sets a standard at 682.3(a):
“Any person who maintains or otherwise possesses consumer information for a business purpose must properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.”
And 682.1(c) defines disposal to include “the discarding or abandonment of consumer information.”
For paper, the rule’s illustrative measure at 682.3(b)(1) is “implementing and monitoring compliance with policies and procedures that require the burning, pulverizing, or shredding of papers containing consumer information so that the information cannot practicably be read or reconstructed.”
So consider what happens every single night in every branch in the country. A cleaner lifts a liner out of a wastebasket at a personal banker’s desk and ties it off.
That is a disposal event.
If anything in that liner is consumer report information, and the liner goes into a dumpster rather than through a shredder, the reasonable-measures standard in 682.3(a) was not met. And the obligation belongs to the institution, not to the person holding the bag.
Which produces the one operational rule we would put above all others in a financial institution:
The cleaning crew must never be in a position to judge what is sensitive.
If a cleaner has to look at a piece of paper and decide whether it belongs in the shredder, the control has already failed — because they will sometimes decide wrongly, they are not trained to make that call, and it was never their call to make.
The fix is a design decision the institution makes once. Every receptacle at every desk is one of two things: a locked shred container the cleaning crew never opens, or a waste container that staff are trained to keep free of customer information. Two kinds of bin, unambiguous, and the crew’s instruction is simply “empty the grey ones, never touch the blue ones.” Then the judgement has been removed from the night shift entirely.
Most branches we walk into have one kind of bin at the desks and a shred console somewhere near the copier. That is a control gap, and it is cheaper to fix than almost anything else on this page.
Why this buyer should not shop on price
Here is the commercial consequence, and we will state it against our own interest.
A bank cannot reduce its vendor due diligence to save a few hundred dollars a month on janitorial. The obligation under §314.4(f) does not scale down with the contract value. So the procurement question for a branch network is not “what is your rate per square foot.” It is “can this company survive our vendor risk management program, and produce the documentation when examiners ask.”
Most janitorial companies cannot. And our honest advice is that your institution should not lower that bar — including for us. Ask for the documentation before you ask for the price. If a provider cannot produce background check records, a named crew list and written confidentiality terms within a few days, the price is irrelevant.
There is a second reason price shopping is the wrong instinct here, and it is structural. When a janitorial contract is squeezed on price, the contractor meets it the only way the maths allows: less supervision, and cheaper, more frequently rotated labour. For almost any other building, that shows up as declining quality. For a bank, it shows up as a different set of unvetted people inside the branch every few months — which is precisely the variable an institution cannot afford to let float. For this buyer, the lowest bid carries the highest risk, and we say that knowing it prices us out of some work.
What to require before anyone gets an alarm code
Take this to any provider bidding on a branch or a network.
| Requirement | Why it exists |
|---|---|
| A named crew list, with advance notice of any change | “A crew” is not an answer. You need individuals, and you need to know when they change |
| Documented background checks on every person with access, re-run on a stated cycle | The due diligence obligation is continuing, not a one-off at onboarding |
| Written prohibition on subcontracting or substitution without approval | An approved vendor sending an unapproved person defeats the whole program |
| Fidelity bonding and current certificates of insurance | A fidelity bond is the one that covers theft by an employee — general liability does not |
| Individually assigned alarm codes and keys, revoked on departure | A shared code tells you a company was there, not who |
| Access logging — arrival and departure, by name, retained | This is how a credit union’s program satisfies the 748.0(b)(4) identification objective |
| Contract language mirroring your own information security program | §314.4(f) requires safeguards to be imposed by contract, not assumed |
| A right to audit, and a stated reassessment cycle | The rule requires periodic assessment based on risk |
| Confidentiality terms covering anything seen in the branch | Not just data — conversations, documents, screens, layouts |
| An incident reporting obligation to a named officer | Anything found, anything wrong, same night — not in a monthly report |
| Camera-aware working protocol | Crews work in camera view; equipment is never parked where it obscures a lens |
| Written no-go zones | Vault and vault area, teller drawers, server and comms rooms, night drop, anything locked |
What we will not claim
We are not your compliance advisor. Your security officer or Qualified Individual owns the information security program and decides what it requires. Our job is to execute inside it, document that we did, and never improvise. Where this article describes regulation, it is describing the published text so you can check it yourself — not advising you on how your examiner will read it.
And we cannot fix a control that belongs to you. If the branch has one kind of bin at every desk and a shred console by the copier, no amount of crew training solves that, because the judgement has been left in the wrong hands. We will tell you it needs changing rather than quietly working around it, which is the version where something eventually ends up in a dumpster.
The Sacramento picture
This region has an unusually dense credit union presence — Golden 1 is headquartered here, and SAFE, Schools Financial, Sacramento Credit Union and others operate branch networks across the county, alongside the regional and national bank branches through Midtown, Natomas, Elk Grove, Roseville and Folsom.
Which matters commercially in both directions. Branch networks are multi-site by nature, so an approved vendor serves many locations rather than one — the reason this sector is worth getting right. And because vendor approval is slow and deliberate, these relationships are rarely re-bid on price once they are working. The diligence that makes this sector hard to enter is the same diligence that makes it stable.
Frequently asked questions
Is a cleaning company a service provider under GLBA?
If it has access to customer information, yes. 16 CFR 314.2(r) defines a service provider as any entity that “receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution.” A crew with after-hours branch access is permitted access, and 314.2(d) includes customer information held “whether in paper, electronic, or other form.” Section 314.4(f) then requires the institution to select providers capable of maintaining safeguards, impose those safeguards by contract, and periodically assess them.
What should a bank require from a janitorial vendor?
A named crew list with notice of changes, documented and periodically repeated background checks on everyone with access, a written prohibition on unapproved substitution or subcontracting, fidelity bonding and current insurance certificates, individually assigned alarm codes and keys that are revoked on departure, retained access logs by name, contract terms mirroring the institution’s information security program, audit rights and a reassessment cycle, confidentiality terms covering anything observed in the branch, same-night incident reporting to a named officer, and written no-go zones.
Can cleaning staff empty wastebaskets in a bank?
They can, but the institution has to make it safe to do so. Under the FTC Disposal Rule at 16 CFR 682.3(a), anyone possessing consumer information for a business purpose must dispose of it “by taking reasonable measures to protect against unauthorized access,” and 682.1(c) treats “discarding or abandonment” as disposal. The practical answer is to remove the judgement from the cleaning crew entirely: locked shred containers they never open, and separate waste containers staff keep free of customer information.
What does NCUA require of credit union service providers?
12 CFR 748.0(a) requires a written security program, which under 748.0(b) must protect offices from “robberies, burglaries, larcenies, and embezzlement,” ensure the security and confidentiality of member records, and “assist in the identification of persons who commit or attempt such actions and crimes.” Appendix A defines a service provider in the same terms as the FTC rule and, at section III.D, requires credit unions to exercise due diligence in selecting service providers, impose appropriate measures by contract, and monitor them where the risk assessment indicates.
Should a bank choose a cleaning company on price?
It is the wrong primary filter. Vendor due diligence obligations do not scale down with contract value, so the first question is whether the provider can survive the institution’s vendor risk management program and produce documentation for examiners. There is also a structural problem: price pressure in janitorial is absorbed through reduced supervision and higher labour turnover, which for a branch means a changing set of people with after-hours access — the one variable a financial institution should not leave floating.
Get assessed before you get quoted
JAN-PRO Commercial Cleaning in Sacramento will give your security officer the vendor documentation first — named crew, background check records, bonding and insurance, confidentiality terms and access protocol — and talk about scope and price after. If your branch has the two-bin problem described above, we will say so.
Call (916) 376-8977 or request a facility visit online.