We have waited a very long time and finally have final rules that implement the FCRA/FACT Act regulations for Identify Theft Red Flags and Duties of Users of Consumer Reports Regarding Address Discrepancies. Section 114 of the FACT Act requires each covered financial institution or creditor to develop and implement a written Identity Theft Prevention Program to detect, prevent, and mitigate identity theft for certain new and existing accounts. It is important to note that Agencies did not restrict these rules to just consumer accounts. The Agencies acknowledge that identity theft is primarily directed toward consumers, but small businesses also have been targets. Therefore, the rules cover consumer accounts and those business accounts that the financial institution or creditor has determined to be at risk.
Before discussing the requirements of the rules, two key terms need to be defined:
-- ACCOUNT is defined as a continuing relationship established by a person with a financial institution or creditor to obtain a product or service for personal, family, or household purposes or business purposes. Accounts include extensions of credit and deposit accounts.
-- COVERED ACCOUNT is defined as: (1) an account that a financial institution or creditor offers or maintains primarily for personal, family, or household purposes that involves or is designed to permit multiple payments or transactions such as a credit card account, mortgage loan, automobile loan, margin account, cell phone account, utility account, checking account, or savings account; and (2) any other account that the financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft, including financial, operational, compliance, reputation, or litigation risks.
To determine if you are a covered financial institution or creditor, a review of the various accounts offered and maintained must be conducted “periodically” to determine whether they are considered covered accounts. (Note that “periodically” is not defined.) For banks, this determination appears easy. However, the difficulty lies in the remainder of the requirement which ties back to part two of the covered account definition; a financial institution or creditor must conduct a risk assessment of its non-consumer accounts.
Once it has been determined that one or more covered accounts are offered or maintained, a written Identity Theft Prevention Program must be developed and implemented. The risk-based Program must be designed to detect, prevent, and mitigate identity theft in covered accounts (new and existing) and must be appropriate to the size and complexity of the financial institution and the nature and scope of its activities.
The Program must include reasonable policies and procedures to address each of the following elements: (1) Identify relevant Red Flags for identity theft for covered accounts and incorporate those Red Flags into the Program; (2) Detect Red Flags that have been incorporated into the Program; (3) Respond appropriately to any Red Flags that are detected to prevent and mitigate identity theft; and (4) Ensure the Program is updated periodically to reflect changes in risks to customers or to the safety and soundness of the financial institution or creditor from identity theft.
The rules also set specific requirements for the continued administration of the Program, which include (1) obtaining approval of the initial written Program by the board of directors or an appropriate committee of the board; (2) providing oversight, development, implementation, and administration of the Program; (3) providing staff training; and (4) overseeing service provider arrangements.
Detailed guidance and examples that must be considered when developing a Program are included in Appendix J and its Supplement. The preamble to the Supplement clarifies that a covered financial institution or creditor will not have to justify why a specific Red Flag was not included in its Program; rather, it will be accountable for the overall effectiveness of its risk-based Program.
The final rules also include provisions for address changes received by a credit or debit card issuer and address discrepancies for users of consumer credit reports. Let’s take a brief look at these requirements.
The FACT Act requires issuers of credit, debit, or certain other cards to assess the validity of a change of address notification for a consumer account when a request for an additional or replacement card is received within a short period of time (at least 30 days) after the address change request. The Agencies acknowledge in the cardholder definition in the preamble that FCRA defines a consumer as an individual. The discussion continues by explaining that identity theft can affect an individual who uses the card for business purposes, which in turn may affect that individual’s consumer credit standing. Therefore, the Agencies extended the provisions of this section to consumers who hold a card for personal, household, family, or business purposes.
The rules also cover cards associated with payroll card accounts and home equity lines of credit. Gift cards and other prepaid card products are excluded, as long as these cards remain excluded from Regulation E.
A card issuer has two options to assess the validity of the address change request before issuing an additional or replacement card. The first option is to notify the cardholder of the address change request at his or her former address or by another means of communication previously agreed to by the issuer and the cardholder and to provide the cardholder with a reasonable means to promptly report an incorrect address change. The notice (written or electronic) must be clear and conspicuous and provided in a separate mailing.
If the card issuer does not wish to notify the cardholder, a second option is provided. This option requires the card issuer to assess the validity of the request in accordance with its Identity Theft Prevention Program. So any financial institution that uses this option must determine another way to verify the validity of the request and incorporate appropriate procedures into its Identity Theft Prevention Program.
The rules also provide the card issuer with the option to validate all address change requests, rather than waiting for a request for an additional or replacement card.
Additional provisions for users of consumer reports are also included in the final rule. Users are required to develop and implement reasonable policies and procedures to handle address discrepancy notices received from a national consumer reporting agency (CRA). An address discrepancy “notice” is provided by a CRA to the user when the address in the user’s consumer report request “substantially” differs from the address in the report. This “notice” will most likely not be a formal notice; rather, it may appear as a code on the consumer report. Thus, the financial institution must be prepared to recognize such a code or some other format as an address discrepancy.
Reasonable policies and procedures must enable the user to:
-- Form a reasonable belief that the consumer report received is for the consumer for whom the report was requested, and
-- Furnish the correct address to the CRA if the financial institution (1) establishes a continuing relationship with the consumer and (2) regularly furnishes information to the CRA.
The second requirement above only applies to new relationships that are established since users are already required to correct and update information for existing customers when furnishing information to a CRA. For the new relationships, the confirmed address must be part of the information that the user regularly furnishes to the CRA for the reporting period in which the new relationship was established.
Beware that there is some excellent information in the preamble that was not included in the final rules. One such bit of information is the Agencies’ expectation regarding the use of consumer reports and reasonable belief. Specifically, the preamble states that the Agencies expect that a financial institution will not use a consumer report if it doesn’t have a reasonable belief that the report relate
Effective Date These rules go into effect on January 1, 2008, but the regulators recognize that it will take time for financial institutions to implement them. As a result, the mandatory compliance date for the rules is November 1, 2008. The final rule is available at