Joint Final Rule: Identity Theft Red Flags Rules
Agency/Agencies: SEC, CFTC
Federal Register Publication Date: 04/19/2013
Summary: The CFTC and the SEC (together, the “Commissions”) jointly issued final rules and guidelines to require certain regulated entities to establish programs to address risks of identity theft. These rules and guidelines implemented provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act, which amended section 615(e) of the Fair Credit Reporting Act and directed the Commissions to adopt rules requiring entities that are subject to the Commissions’ respective enforcement authorities to address identity theft. First, the rules require financial institutions and creditors to develop and implement a written identity theft prevention program designed to detect, prevent, and mitigate identity theft in connection with certain existing accounts or the opening of new accounts. The rules include guidelines to assist entities in the formulation and maintenance of programs that would satisfy the requirements of the rules. Second, the rules establish special requirements for any credit and debit card issuers that are subject to the Commissions’ respective enforcement authorities, to assess the validity of notifications of changes of address under certain circumstances.