FTC Red Flag Update
FTC Will Grant Six-Month Delay Of
Enforcement of 'Red Flags' Rule Requiring Creditors and
Financial institutions to Have Identity Theft Prevention
Programs.
The federal Trade Commission (FTC) will suspend enforcement of
the new "Red Flags Rule" until May 1,2009, to give creditors and
financial institutions and additional time in which to develop
and implement written identity theft prevention programs. This
announcement and the release of an Enforcement Policy Statement
do not affect other federal agencies' enforcement of the
original November 1,2008 deadline for institutions subject to
their oversight to be in compliance.
The Red Flags Rule was developed pursuant to the Fair and
Accurate Credit Transactions (FACT) Act of 2003. Under the Rule,
financial institutions and creditors with covered accounts must
have identity theft prevention programs to identity, detect, and
respond to patterns, practices, or specific activities that
could indicate identity theft.
The Rule applies to creditors and financial institutions.
Federal law defines a creditor to be: any entity that regularly
extends, renews, or continues credit; or any assignee of an
original creditor who is involved in the decision to extend,
renew, or continue credit. Accepting credit cards as a form of
payment does not, in and of itself, make an entity a creditor.
Some examples of creditors are finance companies, automobile
dealers, mortgage brokers, utility companies, telecommunications
companies, and non-profit and government entities that defer
payment for goods or services. Financial institutions include
entitles that offer accounts that enable consumers to write
checks or to make payments to third parties through other means,
such as negotiable instruments or telephone transfers.
The Commission staff launched outreach efforts last year to
explain the Rule to the many different types of entities that
are covered by the Rule. The agency published a general alert on
what the rule requires, and in particular, an explanation of
what types of entities are covered by the Rule -
http://www.ftc.gov/bcp/edu/pubs/business/alerts/alt050.shtm.
During the course of these efforts, Commission staff learned
that some industries and entities within the FTC's jurisdiction
were uncertain about their coverage under the Rule. These
entitles indicated that they were not aware that they were
engaged in activities that would cause them to fall under the
FACT Act's definition of creditor or financial institution. Many
entities also noted that, because they generally are not
required to comply with FTC rules in other contexts, they had
not followed or even been aware of the rulemaking, and therefore
learned of the Rule's requirements too late to be able to come
into compliance by November 1,2008. The commission's delay of
enforcement will enable these entities sufficient time to
establish and implement appropriate identity theft prevention
programs, in compliance with the Rule.
The Federal Trade Commission works for consumers to prevent
fraudulent, deceptive, and unfair business practices and to
provide information to help spot, stop, and avoid them. To file
a complaint in English or Spanish, visit the FTC's online
Complaint Assistant or call 1-877-FTC-Help (1-877-382-4357). The
FTC enters complaints into Consumer Sentinel, a secure, online
database available to more than 1,500 civil and criminal law
enforcement agencies in the U.S. and abroad. The FTC's Web site
provides free information on a variety of consumer topics.
Jeannea