The Federal Trade Commission has announced it will provide additional resources and guidance on compliance with the "Red Flags" Rule and give creditors and financial institutions more time to implement written Identity Theft Prevention Programs. The FTC will delay enforcement of the Rule until November 1, 2009.
The Red Flags Rule is an anti-fraud regulation, requiring creditors and financial institutions with covered accounts to implement programs to identify, detect, and respond to the warning signs, or "red flags," that could indicate identity theft.
The financial regulatory agencies, including the FTC, developed the Rule, which was mandated by the Fair and Accurate Credit Transactions Act of 2003.
FACTA's definition of "creditor" includes any entity that regularly extends or renews credit - or arranges for others to do so - and includes all entities that regularly permit deferred payments for goods or services. Accepting credit cards as a form of payment does not, by itself, make an entity a creditor.
"Financial institutions" include entities that offer accounts that enable consumers to write checks or make payments to third parties through other means, such as other negotiable instruments or telephone transfers.
The FTC says many covered entities have already developed and implemented appropriate, risk-based programs, but some - particularly small businesses and entities with a low risk of identity theft - remain uncertain about their obligations. The additional compliance guidance that the Commission will make available shortly is designed to help them.
The enforcement FAQ states that Commission staff would be unlikely to recommend bringing a law enforcement action if entities know their customers or clients individually, or if they perform services in or around their customers' homes, or if they operate in sectors where identity theft is rare and they have not themselves been the target of identity theft.
The FTC hopes that the three-month extension, coupled with this new guidance, should enable businesses to gain a better understanding of the Rule and any obligations that they may have under it.
The agency claims these steps are consistent with the House Appropriations Committee's recent request that the Commission defer enforcement in conjunction with additional efforts to minimize the burdens of the Rule on healthcare providers and small businesses with a low risk of identity theft problems.
The announcement that the Commission will delay enforcement of the Rule until November 1, 2009, does not affect other federal agencies' enforcement of the original November 1, 2008, compliance deadline for institutions subject to their oversight.
