FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule

At the request of Members of Congress, the Federal Trade Commission is delaying enforcement of the “Red Flags” Rule until June 1, 2010, for financial institutions and creditors subject to enforcement by the FTC.

CAR DEALERS WILL HAVE UNTIL JUNE 1, 2010 TO MEET RED FLAG RULES COMPLIANCE

The Rule was promulgated under the Fair and Accurate Credit Transactions Act, in which Congress directed the Commission and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft. The resulting Red Flags Rule requires all such entities that have “covered accounts” to develop and implement written identity theft prevention programs to help identify, detect, and respond to patterns, practices, or specific activities – known as “red flags” – that could indicate identity theft.

The Commission previously delayed the enforcement of the Rule for entities under its jurisdiction until November 1, 2009. The Commission staff has continued to provide guidance to entities within its jurisdiction, both through materials posted on the dedicated Red Flags Rule Web site (www.ftc.gov/redflagsrule), and in speeches and participation in seminars, conferences and other training events to numerous groups. The Commission also published a compliance guide for business, and created a template that enables low risk entities to create an identity theft program with an easy-to-use online form. FTC staff has published numerous general and industry-specific articles, released a video explaining the Rule, and continues to respond to inquiries from the public. To assist further with compliance, FTC staff has worked with a number of trade associations that have chosen to develop model policies or specialized guidance for their members.

On October 30, 2009, the U.S. District Court for the District of Columbia ruled that the FTC may not apply the Red Flags Rule to attorneys. Today’s announcement that the Commission will delay enforcement of the Rule until June 1, 2010, does not affect the separate timeline of that proceeding and any possible appeals. Nor does it affect other federal agencies’ ongoing enforcement for financial institutions and creditors subject to their oversight.

+++++++++++++++++++++++++++++++++++++++++

we make it simple for you

we provide complete red flag dealer education

comprehensive red flag program is $ 500.

www.gotplates.com

thx

charlotte

800-901-5950

car dealer license training + we make it simple for you

Occupational Licensing Industry News OLIN 2009–11

Red Flags Rule Compliance

New Information

Effective June 1, 2010, the Federal Trade Commission (FTC) will begin enforcement of the Red Flags Rule, a regulation issued under the Fair and Accurate Credit Transactions Act (FACTA), which is a federal law designed to enhance protection against identity theft.

Questions and Answers

Q. What is a red flag?

A. A red flag is a warning sign that identifies a suspicious pattern, practice, or activity that indicates the possible existence of identity theft.

Q. Does the Red Flags Rule list the identity theft warning signs?

A. The Red Flags Rule lists the following identity theft warning signs:

1. Alerts and notifications received from credit reporting agencies and third-party providers.

2. The submission of suspicious documents or suspicious identifying information.

3. Unusual or suspicious account activity.

4. A concern shared by a customer, identify theft victim, or law enforcement.

Q. Who must comply with the Red Flags Rule?

A. The FTC requires all creditors who have covered accounts to comply with the Red Flags Rule. A creditor is an entity that regularly grants loans, arranges for loans or the extension of credit, or makes credit decisions. Covered accounts are primarily personal, family, or household accounts requiring multiple payments or transactions, such as an automobile loan or an account which has a foreseeable risk of identity theft.

Q. Does the Red Flags Rule apply to vehicle dealers?

A. If a dealer extends auto credit to consumers or arranges auto credit for consumers, the rule will most likely apply.

Q. What is required?

A. The Red Flags Rule requires the development and maintenance of a written Identity Theft Prevention Program (ITPP) to detect, prevent, and reduce the possibility of identity theft. The ITPP must include the following four elements:

1. Reasonable policies and procedures to address the “red flags” of identity theft you may encounter in the day-to-day operation of your business.

2. A plan to detect the red flags you’ve identified. For example: if you’ve identified fake IDs as a red flag, then you must have procedures in place to detect possible fake, forged, or altered identification, such as training staff.

3. Appropriate actions to take when red flags are detected.

4. Identify the persons responsible for implementing and administering the program and approval of the program by your board of directors. If you don’t have a board, approval of the ITPP is up to an appropriate senior-level employee. Your ITPP must also include plans for training staff and periodic re-evaluation to reflect new identity theft risks.

Q. Will all ITPPs be the same?

A. While some businesses and organizations may need a comprehensive program that addresses a high risk of identity theft, others with a low risk of identity theft could create a more streamlined program.

Q. What if our company outsources or subcontracts some of our work?

A. If you outsource or subcontract parts of your operation that would be covered by the Red Flags Rule, your ITPP must address how you’ll monitor your contractors’ compliance.

Q. When is the deadline for implementation of the Red Flags Rule?

A. The implementation deadline was November 1, 2008, but the FTC is delaying enforcement of the Red Flags Rule until June 1, 2010, to give creditors and financial institutions additional time to develop and implement written identity theft prevention programs. However, this delay does not prevent other federal agencies from enforcing the Red Flags Rule after November 1, 2008, for institutions subject to their oversight.

Q. Who enforces the Red Flags Rule?

A. The FTC, the federal bank regulatory agencies, and the National Credit Union Administration enforce the Red Flags Rule.

Q. Are there any non-compliance consequences?

A. 1. Federal Administrative Action: The FTC can enact penalties up to $2,500 per violation (15 United States Code §1681 (a)(2)(A)).

2. State Enforcement: States can impose up to $1,000 per violation, plus attorneys’ fees.

3. Civil Liability: Customers can also file civil suits to recover actual damages sustained due to a violation.

Q. Where can I obtain a copy of the FTC guidelines?

A. A copy of the guidelines may be obtained at:

http://ftc.gov/bcp/edu/microsites/redflagsrule/more-about-red-flags.shtm

NOTE: This is only a summary of the Red Flags Rule. Please refer to the FTC guidelines for more comprehensive information.

Background The Fair and Accurate Credit Transactions Act of 2003 (FACTA) amended the Fair Credit Reporting Act of 1970 to combat identity theft and requires joint federal agencies to develop and implement regulations. The regulations are intended to protect consumers by requiring businesses to develop a written ITPP plan. These businesses include those that extend credit or maintain consumer accounts allowing multiple payments or transactions or maintain accounts that have a reasonably foreseeable risk of customer identity theft.

Distribution

Notification that this memo is available online at:

dmv.ca.gov/pubs/olin/olin.htm

was made via e-mail alert in June 2009 to the following:

• All E-mail Alert subscribers. Contact For Red Flags Rule concerns or questions contact the FTC, at:

RedFlags@ftc.gov
MARY GARCIA,

California DMV

Chief

Occupational Licensing

++++++++++++++++++++++++++++

we make it simple for you

thx

charlotte

800-901-5950

red flag rules compliance for car dealers is about good car dealer education