Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003

Federal RegisterNov 9, 2007

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF THE TREASURY

Office of the Comptroller of the Currency

12 CFR Part 41

[Docket ID OCC-2007-0017]

RIN 1557-AC87

FEDERAL RESERVE SYSTEM

12 CFR Part 222

[Docket No. R-1255]

FEDERAL DEPOSIT INSURANCE CORPORATION

12 CFR Parts 334 and 364

RIN 3064-AD00

DEPARTMENT OF THE TREASURY

Office of Thrift Supervision

12 CFR Part 571

[Docket No. OTS-2007-0019]

RIN 1550-AC04

NATIONAL CREDIT UNION ADMINISTRATION

12 CFR Part 717

FEDERAL TRADE COMMISSION

16 CFR Part 681

RIN 3084-AA94

Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003

AGENCIES:

Office of the Comptroller of the Currency, Treasury (OCC); Board of Governors of the Federal Reserve System (Board); Federal Deposit Insurance Corporation (FDIC); Office of Thrift Supervision, Treasury (OTS); National Credit Union Administration (NCUA); and Federal Trade Commission (FTC or Commission).

ACTION:

Joint final rules and guidelines.

SUMMARY:

The OCC, Board, FDIC, OTS, NCUA and FTC (the Agencies) are jointly issuing final rules and guidelines implementing section 114 of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act) and final rules implementing section 315 of the FACT Act. The rules implementing section 114 require each financial institution or creditor to develop and implement a written Identity Theft Prevention Program (Program) to detect, prevent, and mitigate identity theft in connection with the opening of certain accounts or certain existing accounts. In addition, the Agencies are issuing guidelines to assist financial institutions and creditors in the formulation and maintenance of a Program that satisfies the requirements of the rules. The rules implementing section 114 also require credit and debit card issuers to assess the validity of notifications of changes of address under certain circumstances. Additionally, the Agencies are issuing joint rules under section 315 that provide guidance regarding reasonable policies and procedures that a user of consumer reports must employ when a consumer reporting agency sends the user a notice of address discrepancy.

DATES:

The joint final rules and guidelines are effective January 1, 2008. The mandatory compliance date for this rule is November 1, 2008.

FOR FURTHER INFORMATION CONTACT:

OCC:

Amy Friend, Assistant Chief Counsel, (202) 874-5200; Deborah Katz, Senior Counsel, or Andra Shuster, Special Counsel, Legislative and Regulatory Activities Division, (202) 874-5090; Paul Utterback, Compliance Specialist, Compliance Department, (202) 874-5461; or Aida Plaza Carter, Director, Bank Information Technology, (202) 874-4740, Office of the Comptroller of the Currency, 250 E Street, SW., Washington, DC 20219.

Board:

David A. Stein or Ky Tran-Trong, Counsels, or Amy Burke, Attorney, Division of Consumer and Community Affairs, (202) 452-3667; Kara L. Handzlik, Attorney, Legal Division, (202) 452-3852; or John Gibbons, Supervisory Financial Analyst, Division of Banking Supervision and Regulation, (202) 452-6409, Board of Governors of the Federal Reserve System, 20th and C Streets, NW., Washington, DC 20551.

FDIC:

Jeffrey M. Kopchik, Senior Policy Analyst, (202) 898-3872, or David P. Lafleur, Policy Analyst, (202) 898-6569, Division of Supervision and Consumer Protection; Richard M. Schwartz, Counsel, (202) 898-7424, or Richard B. Foley, Counsel, (202) 898-3784, Legal Division, Federal Deposit Insurance Corporation, 550 17th Street, NW., Washington, DC 20429.

OTS:

Ekita Mitchell, Consumer Regulations Analyst, Compliance and Consumer Protection, (202) 906-6451; Kathleen M. McNulty, Technology Program Manager, Information Technology Risk Management, (202) 906-6322; or Richard Bennett, Senior Compliance Counsel, Regulations and Legislation Division, (202) 906-7409, Office of Thrift Supervision, 1700 G Street, NW., Washington, DC 20552.

NCUA:

Regina M. Metz, Staff Attorney, Office of General Counsel, (703) 518-6540, National Credit Union Administration, 1775 Duke Street, Alexandria, VA 22314-3428.

FTC:

Naomi B. Lefkovitz, Attorney, or Pavneet Singh, Attorney, Division of Privacy and Identity Protection, Bureau of Consumer Protection, (202) 326-2252, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington DC 20580.

SUPPLEMENTARY INFORMATION:

I. Introduction

The President signed the FACT Act into law on December 4, 2003.

The FACT Act added several new provisions to the Fair Credit Reporting Act of 1970 (FCRA), 15 U.S.C. 1681

et seq.

Section 114 of the FACT Act, 15 U.S.C. 1681m(e), amends section 615 of the FCRA, and directs the Agencies to issue joint regulations and guidelines regarding the detection, prevention, and mitigation of identity theft, including special regulations requiring debit and credit card issuers to validate notifications of changes of address under certain circumstances.

Section 315 of the FACT Act, 15 U.S.C. 1681c(h), adds a new section 605(h)(2) to the FCRA requiring the Agencies to issue joint regulations that provide guidance regarding reasonable policies and procedures that a user of a consumer report should employ when the user receives a notice of address discrepancy.

Pub. L. 108-159.

Section 111 of the FACT Act defines “identity theft” as “a fraud committed using the identifying information of another person, subject to such further definition as the [Federal Trade] Commission may prescribe, by regulation.” 15 U.S.C. 1681a(q)(3).

On July 18, 2006, the Agencies published a joint notice of proposed rulemaking (NPRM) in the

Federal Register

(71 FR 40786) proposing rules and guidelines to implement section 114 and proposing rules to implement section 315 of the FACT Act. The public comment period closed on September 18, 2006. The Agencies collectively received a total of 129 comments in response to the NPRM, although many commenters sent copies of the same letter to each of the Agencies. The comments included 63 from financial institutions, 12 from financial institution holding companies, 23 from financial institution trade associations, 12 from individuals, nine from other trade associations, five from other business entities, three from consumer

groups,

one from a member of Congress, and one from the United States Small Business Administration (SBA).

One of these letters represented the comments of five consumer groups.

II. Section 114 of the FACT Act

A. Red Flag Regulations and Guidelines

1. Background

Section 114 of the FACT Act requires the Agencies to jointly issue guidelines for financial institutions and creditors regarding identity theft with respect to their account holders and customers. Section 114 also directs the Agencies to prescribe joint regulations requiring each financial institution and creditor to establish reasonable policies and procedures for implementing the guidelines, to identify possible risks to account holders or customers or to the safety and soundness of the institution or “customer.”

Use of the term “customer,” here, appears to be a drafting error and likely should read “creditor.”

In developing the guidelines, the Agencies must identify patterns, practices, and specific forms of activity that indicate the possible existence of identity theft. The guidelines must be updated as often as necessary, and cannot be inconsistent with the policies and procedures issued under section 326 of the USA PATRIOT Act,

31 U.S.C. 5318(l), that require verification of the identity of persons opening new accounts. The Agencies also must consider including reasonable guidelines that would apply when a transaction occurs in connection with a consumer's credit or deposit account that has been inactive for two years. These guidelines would provide that in such circumstances, a financial institution or creditor “shall follow reasonable policies and procedures” for notifying the consumer, “in a manner reasonably designed to reduce the likelihood of identity theft.”

Pub. L. 107-56.

2. Overview of Proposal and Comments Received

The Agencies proposed to implement section 114 through regulations requiring each financial institution and creditor to implement a written Program to detect, prevent and mitigate identity theft in connection with the opening of an account or any existing account. The Agencies also proposed guidelines that identified 31 patterns, practices, and specific forms of activity that indicate a possible risk of identity theft. The proposed regulations required each financial institution and creditor to incorporate into its Program relevant indicators of a possible risk of identity theft (Red Flags), including indicators from among those listed in the guidelines. To promote flexibility and responsiveness to the changing nature of identity theft, the proposed rules also stated that covered entities would need to include in their Programs relevant Red Flags from applicable supervisory guidance, their own experiences, and methods that the entity had identified that reflect changes in identity theft risks.

The Agencies invited comment on all aspects of the proposed regulations and guidelines implementing section 114, and specifically requested comment on whether the elements described in section 114 had been properly allocated between the proposed regulations and the proposed guidelines.

Consumer groups maintained that the proposed regulations provided too much discretion to financial institutions and creditors to decide which accounts and Red Flags to include in their Programs and how to respond to those Red Flags. These commenters stated that the flexible and risk-based approach taken in the proposed rulemaking would permit “business as usual.”

Some small financial institutions also expressed concern about the flexibility afforded by the proposal. These commenters stated that they preferred to have clearer, more structured guidance describing exactly how to develop and implement a Program and what they would need to do to achieve compliance.

Most commenters, however, including many financial institutions and creditors, asserted that the proposal was overly prescriptive, contained requirements beyond those mandated in the FACT Act, would be costly and burdensome to implement, and would complicate the existing efforts of financial institutions and creditors to detect and prevent identity theft. Some industry commenters asserted that the rulemaking was unnecessary because large businesses, such as banks and telecommunications companies, already are motivated to prevent identity theft and other forms of fraud in order to limit their own financial losses. Financial institution commenters maintained that they are already doing most of what would be required by the proposal as a result of having to comply with the customer identification program (CIP) regulations implementing section 326 of the USA PATRIOT Act

and other existing requirements. These commenters suggested that the regulations and guidelines take the form of broad objectives modeled on the objectives set forth in the “Interagency Guidelines Establishing Information Security Standards” (Information Security Standards).

A few financial institution commenters asserted that the primary cause of identity theft is the lack of care on the part of the consumer. They stated that consumers should be held responsible for protecting their own identifying information.

See, e.g.

, 31 CFR 103.121 (applicable to banks, thrifts and credit unions and certain non-federally regulated banks).

12 CFR part 30, app. B (national banks); 12 CFR part 208, app. D-2 and part 225, app. F (state member banks and holding companies); 12 CFR part 364, app. B (state non-member banks); 12 CFR part 570, app. B (savings associations); 12 CFR part 748, App. A (credit unions).

The Agencies have modified the proposed rules and guidelines in light of the comments received. An overview of the final rules, guidelines, and supplement, a discussion of the comments, and the specific manner in which the proposed rules and guidelines have been modified, follows.

3. Overview of final rules and guidelines

The Agencies are issuing final rules and guidelines that provide both flexibility and more guidance to financial institutions and creditors. The final rules also require the Program to address accounts where identity theft is most likely to occur. The final rules describe which financial institutions and creditors are required to have a Program, the objectives of the Program, the elements that the Program must contain, and how the Program must be administered.

Under the final rules, only those financial institutions and creditors that offer or maintain “covered accounts” must develop and implement a written Program. A covered account is (1) an account primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, or (2) any other account for which there is a reasonably foreseeable risk to customers or the safety and soundness of the financial institution or creditor from identity theft. Each financial institution and creditor must periodically determine whether it offers or maintains a “covered account.”

The final regulations provide that the Program must be designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. In addition, the Program must be tailored to the entity's size, complexity and nature of its operations.

The final regulations list the four basic elements that must be included in the Program of a financial institution or creditor. The Program must contain “reasonable policies and procedures” to:

• Identify relevant Red Flags for covered accounts and incorporate those Red Flags into the Program;

• Detect Red Flags that have been incorporated into the Program;

• Respond appropriately to any Red Flags that are detected to prevent and mitigate identity theft; and

• Ensure the Program is updated periodically, to reflect changes in risks to customers or to the safety and soundness of the financial institution or creditor from identity theft.

The regulations also enumerate certain steps that financial institutions and creditors must take to administer the Program. These steps include obtaining approval of the initial written Program by the board of directors or a committee of the board, ensuring oversight of the development, implementation and administration of the Program, training staff, and overseeing service provider arrangements.

In order to provide financial institutions and creditors with more flexibility in developing a Program, the Agencies have moved certain detail formerly contained in the proposed regulations to the guidelines located in Appendix J. This detailed guidance should assist financial institutions and creditors in the formulation and maintenance of a Program that satisfies the requirements of the regulations to detect, prevent, and mitigate identity theft. Each financial institution or creditor that is required to implement a Program must consider the guidelines and include in its Program those guidelines that are appropriate. The guidelines provide policies and procedures for use by institutions and creditors, where appropriate, to satisfy the requirements of the final rules, including the four elements listed above. While an institution or creditor may determine that particular guidelines are not appropriate to incorporate into its Program, the Program must nonetheless contain reasonable policies and procedures to meet the specific requirements of the final rules. The illustrative examples of Red Flags formerly in Appendix J are now listed in a supplement to the guidelines.

4. Section-by-Section Analysis

The OCC, Board, FDIC, OTS and NCUA are placing the regulations and guidelines implementing section 114 in the part of their regulations that implement the FCRA—12 CFR parts 41, 222, 334, 571, and 717, respectively. In addition, the FDIC cross-references the regulations and guidelines in 12 CFR part 364. For ease of reference, the discussion in this preamble uses the shared numerical suffix of each of these agency's regulations. The FTC also is placing the final regulations and guidelines in the part of its regulations implementing the FCRA, specifically 16 CFR part 681. However, the FTC uses different numerical suffixes that equate to the numerical suffixes discussed in the preamble as follows: preamble suffix .82 = FTC suffix .1, preamble suffix .90 = FTC suffix .2, and preamble suffix .91 = FTC suffix .3. In addition, Appendix J referenced in the preamble is the FTC's Appendix A.

Section _.90(a) Purpose and Scope

Proposed §_.90(a) described the statutory authority for the proposed regulations, namely, section 114 of the FACT Act. It also defined the scope of this section; each of the Agencies proposed tailoring this paragraph to describe those entities to which this section would apply. The Agencies received no comments on this section, and it is adopted as proposed.

Section _.90(b) Definitions

Proposed §_.90(b) contained definitions of various terms that applied to the proposed rules and guidelines. While §_.90(b) of the final rules continues to describe the definitions applicable to the final rules and guidelines, changes have been made to address the comments, as follows.

Section _.90(b)(1) Account.

The Agencies proposed using the term “account” to describe the relationships covered by section 114 that an account holder or customer may have with a financial institution or creditor.

The proposed definition of “account” was “a continuing relationship established to provide a financial product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such a financial activity under section 4(k) of the Bank Holding Company Act, 12 U.S.C. 1843(k).” The definition also gave examples of types of “accounts.”

The Agencies acknowledged that section 114 does not use the term “account” and, in other contexts, the FCRA defines the term “account” narrowly to describe certain consumer deposit or asset accounts. See 15 U.S.C. 1681a(r)(4).

Some commenters stated that the regulations do not need a definition of “account” to give effect to their terms. Some commenters maintained that a new definition for “account” would be confusing as this term is already defined inconsistently in several regulations and in section 615(e) of the FCRA. These commenters recommended that the Agencies use the term “continuing relationship” instead, and define this phrase in a manner consistent with the Agencies” privacy rules

implementing Title V of the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. 6801.

These commenters urged that the definition of “account” not be expanded to include relationships that are not “continuing.” They stated that it would be very burdensome to gather and maintain information on non-customers for one-time transactions. Other commenters suggested defining the term “account” in a manner consistent with the CIP rules.

See

12 CFR 40 (OCC); 12 CFR 216 (Board); 12 CFR 332 (FDIC); 12 CFR 573 (OTS); 12 CFR 716 (NCUA); and 16 CFR 313 (FTC).

Pub. L. 106-102.

Many commenters stated that defining “account” to cover both consumer and business accounts was too broad, exceeded the scope of the FACT Act, and would make the regulation too burdensome. These commenters recommended limiting the scope of the regulations and guidelines to cover only consumer financial services, specifically accounts established for personal, family and household purposes, because these types of accounts typically are targets of identity theft. They asserted that identity theft has not historically been common in connection with business or commercial accounts.

Consumer groups maintained that the proposed definition of “account” was too narrow. They explained that because the proposed definition was tied to financial products and services that can be offered under the Bank Holding Company Act, it inappropriately excluded certain transactions involving creditors that are not financial institutions that should be covered by the regulations. Some of these commenters recommended that the definition of “account” include any relationship with a financial institution or creditor in which funds could be intercepted or credit could be extended, as well as any other transaction which could obligate an individual or other covered entity, including transactions that do not result in a continuing relationship. Others suggested that there should be no flexibility to exclude any account that is held by an individual or which generates information about individuals that reflects on their financial or credit reputations.

The Agencies have modified the definition of “account” to address these comments. First, the final rules now apply to “covered accounts,” a term that the Agencies have added to the definition section to eliminate

confusion between these rules and other rules that apply to an “account.” The Agencies have retained a definition of “account” simply to clarify and provide context for the definition of “covered account.”

Section 114 provides broad discretion to the Agencies to prescribe regulations and guidelines to address identity theft. The terminology in section 114 is not confined to “consumer” accounts. While identity theft primarily has been directed at consumers, the Agencies are aware that small businesses also have been targets of identity theft. Over time, identity theft could expand to affect other types of accounts. Thus, the definition of “account” in §_.90(b)(1) of the final rules continues to cover

any

relationship to obtain a product or service that an account holder or customer may have with a financial institution or creditor.

Through examples, the definition makes clear that the purchase of property or services involving a deferred payment is considered to be an account.

Accordingly, the definition of “account” still applies to fiduciary, agency, custodial, brokerage and investment advisory activities.

Although the definition of “account” includes business accounts, the risk-based nature of the final rules allows each financial institution or creditor flexibility to determine which business accounts will be covered by its Program through a risk evaluation process.

The Agencies also recognize that a person may establish a relationship with a creditor, such as an automobile dealer or a telecommunications provider, primarily to obtain a product or service that is not financial in nature. To make clear that an “account” includes relationships with creditors that are not financial institutions, the definition is no longer tied to the provision of “financial” products and services. Accordingly, the Agencies have deleted the reference to the Bank Holding Company Act.

The definition of “account” still includes the words “continuing relationship.” The Agencies have determined that, at this time, the burden that would be imposed upon financial institutions and creditors by a requirement to detect, prevent and mitigate identity theft in connection with single, non-continuing transactions by non-customers would outweigh the benefits of such a requirement. The Agencies recognize, however, that identity theft may occur at the time of account opening. Therefore, as detailed below, the obligations of the final rule apply not only to existing accounts, where a relationship already has been established, but also to account openings, when a relationship has not yet been established.

Section _.90(b)(2) Board of Directors.

The proposed regulations discussed the role of the board of directors of a financial institution or creditor. For financial institutions and creditors covered by the regulations that do not have boards of directors, the proposed regulations defined “board of directors” to include, in the case of a branch or agency of a foreign bank, the managing official in charge of the branch or agency. For other creditors that do not have boards of directors, the proposed regulations defined “board of directors” as a designated employee.

Consumer groups objected to the proposed definition as it applied to creditors that do not have boards of directors. These commenters recommended that for these entities, “board of directors” should be defined as a designated employee at the level of senior management. They asserted that otherwise, institutions that do not have a board of directors would be given an unfair advantage for purposes of the substantive provisions of the rules, because they would be permitted to assign

any

employee to fulfill the role of the “board of directors.”

The Agencies agree this important role should be performed by an employee at the level of senior management, rather than any designated employee. Accordingly, the definition of “board of directors” has been revised in § _.90(b)(2) of the final rules so that, in the case of a creditor that does not have a board of directors, the term “board of directors” means “a designated employee at the level of senior management.”

Section _.90(b)(3) Covered Account.

As mentioned previously, the Agencies have added a new definition of “covered account” in § _.90(b)(3) to describe the type of “account” covered by the final rules. The proposed rules would have provided a financial institution or creditor with broad flexibility to apply its Program to those accounts that it determined were vulnerable to the risk of identity theft, and did not mandate coverage of any particular type of account.

Consumer group commenters urged the Agencies to limit the discretion afforded to financial institutions and creditors by requiring them to cover consumer accounts in their Programs. While seeking to preserve their discretion, many industry commenters requested that the Agencies limit the final rules to consumer accounts, where identity theft is most likely to occur.

The Agencies recognize that consumer accounts are presently the most common target of identity theft and acknowledge that Congress expected the final regulation to address risks of identity theft to consumers.

For this reason, the final rules require each Program to cover accounts established primarily for personal, family or household purposes, that involve or are designed to permit multiple payments or transactions,

i.e.

, consumer accounts. As discussed above in connection with the definition of “account,” the final rules also require the Programs of financial institutions and creditors to cover any other type of account that the institution or creditor offers or maintains for which there is a reasonably foreseeable risk from identity theft.

See

S. Rep. No. 108-166 at 13 (Oct. 17, 2003) (accompanying S. 1753).

Accordingly, the definition of “covered account” is divided into two parts. The first part refers to “an account that a financial institution or creditor offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions.” The definition provides examples to illustrate that these types of consumer accounts include, “a credit card account, mortgage loan, automobile loan, margin account, cell phone account, utility account, checking account, or savings account.”

These examples reflect the fact that the rules are applicable to a variety of financial institutions and creditors. They are not intended to confer any additional powers on covered entities. Nonetheless, some of the Agencies have chosen to limit the examples in their rule texts to those products covered entities subject to their jurisdiction are legally permitted to offer.

The second part of the definition refers to “any other account that the financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft, including financial, operational, compliance, reputation, or litigation risks.” This part of the definition reflects the Agencies' belief that other types of accounts, such as small business accounts or sole proprietorship accounts, may be vulnerable to identity theft, and, therefore, should be considered for coverage by the Program of a financial institution or creditor.

In response to the proposed definition of “account,” a trade association representing credit unions suggested that the term “customer” in the definition be revised to refer to

“member” to better reflect the ownership structure of some financial institutions or to “consumer” to include all individuals doing business at all types of financial institutions. The definition of “account” in the final rules no longer makes reference to the term “customer”; however, the definition of “covered account” continues to employ this term, to be consistent with section 114 of the FACT Act, which uses the term “customer.” Of course, in the case of credit unions, the final rules and guidelines will apply to the accounts of members that are maintained primarily for personal, family, or household purposes, and those that are otherwise subject to a reasonably foreseeable risk of identity theft.

Sections _.90(b)(4) and (b)(5) Credit and Creditor.

The proposed rules defined these terms by cross-reference to the relevant sections of the FCRA. There were no comments on the definition of “credit” and § _.90(b)(4) of the final rules adopts the definition as proposed.

Some commenters asked the Agencies to clarify that the term “creditor” does not cover third-party debt collectors who regularly arrange for the extension, renewal, or continuation of credit.

Section 114 applies to financial institutions and creditors. Under the FCRA, the term “creditor” has the same meaning as in section 702 of the Equal Credit Opportunity Act (ECOA), 15 U.S.C. 1691a.

ECOA defines “creditor” to include a person who arranges for the extension, renewal, or continuation of credit, which in some cases could include third-party debt collectors. 15 U.S.C. 1691a(e). Therefore, the Agencies are not excluding third-party debt collectors from the scope of the final rules, and § _.90(b)(5) of the final rules adopts the definition of “creditor” as proposed.

See

15 U.S.C. 1681a(r)(5).

Section _.90(b)(6) Customer.

Section 114 of the FACT Act refers to “account holders” and “customers” of financial institutions and creditors without defining either of these terms. For ease of reference, the Agencies proposed to use the term “customer” to encompass both “customers” and “account holders.” “Customer” was defined as a person that has an account with a financial institution or creditor. The proposed definition of “customer” applied to any “person,” defined by the FCRA as any individual, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity.

The proposal explained that the Agencies chose this broad definition because, in addition to individuals, various types of entities (

e.g.

, small businesses) can be victims of identity theft. Under the proposed definition, however, a financial institution or creditor would have had the discretion to determine which type of customer accounts would be covered under its Program, since the proposed regulations were risk-based.

See

15 U.S.C. 1681a(b).

Proposed § _.90(d)(1) required this determination to be substantiated by a risk evaluation that takes into consideration which customer accounts of the financial institution or creditor are subject to a risk of identity theft.

As noted above, most industry commenters maintained that including all persons, not just consumers, within the definition of “customer” would impose a substantial financial burden on financial institutions and creditors, and make compliance with the regulations more burdensome. These commenters stated that business identity theft is rare, and maintained that financial institutions and creditors should be allowed to direct their fraud prevention resources to the areas of highest risk. They also noted that businesses are more sophisticated than consumers, and are in a better position to protect themselves against fraud than consumers, both in terms of prevention and in enforcing their legal rights.

Some financial institution commenters were concerned that the broad definition of “customer” would create opportunities for commercial customers to shift responsibility from themselves to the financial institution for not discovering Red Flags and alerting business customers about embezzlement or other fraudulent transactions by the commercial customer's own employees. These commenters suggested narrowing the definition to cover natural persons and to exclude business customers. Some of these commenters suggested that the definition of “customer” should be consistent with the definition of this term in the Information Security Standards and the Agencies' privacy rules.

Consumer groups commented that the proposed definition of “customer” was too narrow. They recommended that the definition be amended, so that the regulations would not only protect persons who are already customers of a financial institution or creditor, but also persons whose identities are used by an imposter to open an account.

Section _.90(b)(6) of the final rule defines “customer” to mean a person that has a “covered account” with a financial institution or creditor. Under the definition of “covered account,” an individual who has a consumer account will always be a “customer.” A “customer” may also be a person that has another type of account for which a financial institution or creditor determines there is a reasonably foreseeable risk to its customers or to its own safety and soundness from identity theft.

The Agencies note that the Information Security Standards and the privacy rules implemented various sections of Title V of the GLBA, 15 U.S.C. 6801, which specifically apply only to customers who are consumers. By contrast, section 114 does not define the term “customer.” Because the Agencies continue to believe that a business customer can be a target of identity theft, the final rules contain a risk-based process designed to ensure that these types of customers will be covered by the Program of a financial institution or creditor, when the risk of identity theft is reasonably foreseeable.

The definition of “customer” in the final rules continues to cover only customers that already have accounts. The Agencies note, however, that the substantive provisions of the final rules, described later, require the Program of a financial institution or creditor to detect, prevent, and mitigate identity theft in connection with the opening of a covered account as well as any existing covered account. The final rules address persons whose identities are used by an imposter to open an account in these substantive provisions, rather than through the definition of “customer.”

Section _.90(b)(7) Financial Institution.

The Agencies received no comments on the proposed definition of “financial institution.” It is adopted in § _.90(b)(7), as proposed, with a cross-reference to the relevant definition in the FCRA.

Section _.90(b)(8) Identity Theft.

The proposal defined “identity theft” by cross-referencing the FTC's rule that defines “identity theft” for purposes of the FCRA.

69 FR 63922 (Nov. 3, 2004) (codified at 16 CFR 603.2(a)). Section 111 of the FACT Act added several new definitions to the FCRA, including “identity theft,” and authorized the FTC to further define this term.

See

15 U.S.C. 1681a.

Most industry commenters objected to the breadth of the proposed definition of “identity theft.” They recommended that the definition include only actual fraud committed using identifying information of a consumer, and exclude attempted fraud, identity theft committed against businesses, and any identity fraud involving the creation of a fictitious identity using fictitious data combined with real information from

multiple individuals. By contrast, consumer groups supported a broad interpretation of “identity theft,” including the incorporation of “attempted fraud” in the definition.

Section _.90(b)(8) of the final rules adopts the definition of “identity theft” as proposed. The Agencies believe that it is important to ensure that all provisions of the FACT Act that address identity theft are interpreted in a consistent manner. Therefore, the final rule continues to define identity theft with reference to the FTC's regulation, which as currently drafted provides that the term “identity theft” means “a fraud committed or attempted using the identifying information of another person without authority.”

The FTC defines the term “identifying information” to mean “any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including any—

See

16 CFR 603.2(a).

(1) Name, social security number, date of birth, official State or government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number;

(2) Unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation;

(3) Unique electronic identification number, address, or routing code; or

(4) Telecommunication identifying information or access device (as defined in 18 U.S.C. 1029(e)).

Thus, under the FTC's regulation, the creation of a fictitious identity using any single piece of information belonging to a real person falls within the definition of “identity theft” because such a fraud involves “using the identifying information of another person without authority.”

See

16 CFR 603.2(b).

Section _.90(b)(9) Red Flag.

The proposed regulations defined “Red Flag” as a pattern, practice, or specific activity that indicates the possible risk of identity theft. The preamble to the proposed rules explained that indicators of a “possible risk” of identity theft would include precursors to identity theft such as phishing,

and security breaches involving the theft of personal information, which often are a means to acquire the information of another person for use in committing identity theft. The preamble explained that the Agencies included such precursors to identity theft as “Red Flags” to better position financial institutions and creditors to stop identity theft at its inception.

Electronic messages to customers of financial institutions and creditors directing them to provide personal information in response to a fraudulent e-mail.

Most industry commenters objected to the broad scope of the definition of “Red Flag,” particularly the phrase “possible risk of identity theft.” These commenters believed that this definition would require financial institutions and creditors to identify all risks and develop procedures to prevent or mitigate them, without regard to the significance of the risk. They asserted that the statute does not support the use of “possible risk” and suggested defining a “Red Flag” as an indicator of significant, substantial, or the probable risk of identity theft. These commenters stated that this would allow a financial institution or creditor to focus compliance in areas where it is most needed.

Most industry commenters also stated that the inclusion of precursors to identity theft in the definition of “Red Flag” would make the regulations even broader and more burdensome. They stated that financial institutions and creditors do not have the ability to detect and respond to precursors, such as phishing, in the same manner as other Red Flags that are more indicative of actual ongoing identity theft.

By contrast, consumer groups supported the inclusion of the phrase “possible risk of identity theft” and the reference to precursors in the proposed definition of “Red Flag.” These commenters stated that placing emphasis on detecting precursors to identity theft, instead of waiting for proven cases, is the right approach.

The Agencies have concluded that the phrase “possible risk” in the proposed definition of “Red Flag” is confusing and could unduly burden entities with limited resources. Therefore, the final rules define “Red Flag” in § _.90(b)(9) using language derived directly from section 114, namely, “a pattern, practice, or specific activity that indicates the possible existence of identity theft.”

15 U.S.C. 1681m(c)(2)(A).

The Agencies continue to believe, however, that financial institutions and creditors should consider precursors to identity theft in order to stop identity theft before it occurs. Therefore, as described below, the Agencies have chosen to address precursors directly, through a substantive provision in section IV of the guidelines titled “Prevention and Mitigation,” rather than through the definition of “Red Flag.” This provision states that a financial institution or creditor should consider aggravating factors that may heighten the risk of identity theft in determining an appropriate response to the Red Flags it detects.

Section _.90(b)(10) Service Provider.

The proposed regulations defined “service provider” as a person that provides a service directly to the financial institution or creditor. This definition was based upon the definition of “service provider” in the Information Security Standards.

The Information Security Standards define “service provider” to mean any person or entity that maintains, processes, or otherwise is permitted access to customer information or consumer information through the provision of services directly to the financial institution. 12 CFR part 30, app. B (national banks); 12 CFR part 208, app. D-2 and part 225, app. F (state member banks and holding companies); 12 CFR part 364, app. B (state non-member banks); 12 CFR part 570, app. B (savings associations); 12 CFR part 748, App. A (credit unions).

One commenter agreed with this definition. However, two other commenters stated that the definition was too broad. They suggested narrowing the definition of “service provider” to persons or entities that have access to customer information.

Section _.90(b)(10) of the final rules adopts the definition as proposed. The Agencies have concluded that defining “service provider” to include only persons that have access to customer information would inappropriately narrow the coverage of the final rules. The Agencies have interpreted section 114 broadly to require each financial institution and creditor to detect, prevent, and mitigate identity theft not only in connection with any existing covered account, but also in connection with the opening of an account. A financial institution or creditor is ultimately responsible for complying with the final rules and guidelines even if it outsources an activity to a third-party service provider. Thus, a financial institution or creditor that uses a service provider to open accounts will need to provide for the detection, prevention, and mitigation of identity theft in connection with this activity, even when the service provider has access to the information of a person who is not yet, and may not become, a “customer.”

Section _.90(c) Periodic Identification of Covered Accounts

To simplify compliance with the final rules, the Agencies added a new provision in § _.90(c) that requires each financial institution and creditor to periodically determine whether it offers or maintains any covered accounts. As a part of this determination, a financial institution or creditor must conduct a risk assessment to determine whether it

offers or maintains covered accounts described in § _.90(b)(3)(ii) (accounts other than consumer accounts), taking into consideration:

• The methods it provides to open its accounts;

• The methods it provides to access its accounts; and

• Its previous experiences with identity theft.

Thus, a financial institution or creditor should consider whether, for example, a reasonably foreseeable risk of identity theft may exist in connection with business accounts it offers or maintains that may be opened or accessed remotely, through methods that do not require face-to-face contact, such as through the internet or telephone. In addition, those institutions and creditors that offer or maintain business accounts that have been the target of identity theft should factor those experiences with identity theft into their determination.

This provision is modeled on various process-oriented and risk-based regulations issued by the Agencies, such as the Information Security Standards. Compliance with this type of regulation is based upon a regulated entity's own preliminary risk assessment. The risk assessment required here directs a financial institution or creditor to determine, as a threshold matter, whether it will need to have a Program.

If a financial institution or creditor determines that it does need a Program, then this risk assessment will enable the financial institution or creditor to identify those accounts the Program must address. This provision also requires a financial institution or creditor that initially determines that it does not need to have a Program to reassess periodically whether it must develop and implement a Program in light of changes in the accounts that it offers or maintains and the various other factors set forth in the provision.

The Agencies anticipate that some financial institutions and creditors, such as various creditors regualted by the FTC that solely engage in business-to-business transactions, will be able to determine that they do not need to develop and implement a Program.

Section _.90(d)(1) Identity Theft Prevention Program Requirement

Proposed § _.90(c) described the primary objectives of a Program. It stated that each financial institution or creditor must implement a written Program that includes reasonable policies and procedures to address the risk of identity theft to its customers and to the safety and soundness of the financial institution or creditor, in the manner described in proposed § _.90(d), which described the development and implementation of a Program. It also stated that the Program must address financial, operational, compliance, reputation, and litigation risks and be appropriate to the size and complexity of the financial institution or creditor and the nature and scope of its activities.

Some commenters believed that the proposed regulations exceeded the scope of section 114 by covering deposit accounts and by requiring a response to the risk of identity theft, not just the identification of the risk of identity theft. One commenter expressed concern about the application of the Program to existing accounts.

The SBA commented that requiring all small businesses covered by the regulations to create a written Program would be overly burdensome. Several financial institution commenters objected to what they perceived as a proposed requirement that financial institutions and creditors have a written Program solely to address identity theft. They recommended that the final regulations allow a covered entity to simply maintain or expand its existing fraud prevention and information security programs as long as they included the detection, prevention, and mitigation of identity theft. Some of these commenters stated that requiring a written program would merely focus examiner attention on documentation and cause financial institutions to produce needless paperwork.

While commenters generally agreed that the Program should be appropriate to the size and complexity of the financial institution or creditor, and the nature and scope of its activities, many industry commenters objected to the prescriptive nature of this section. They urged the Agencies to provide greater flexibility to financial institutions and creditors by allowing them to implement their own procedures as opposed to those provided in the proposed regulations. Several other commenters suggested permitting financial institutions and creditors to take into account the cost and effectiveness of policies and procedures and the institution's history of fraud when designing its Program.

Several financial institution commenters maintained that the Program required by the proposed rules was not sufficiently flexible. They maintained that a true risk-based approach would permit institutions to prioritize the importance of various controls, address the most important risks first, and accept the good faith judgments of institutions in differentiating among their options for conducting safe, sound, and compliant operations. Some of these commenters urged the Agencies to revise the final rules and guidelines and adopt an approach similar to the Information Security Standards which they characterized as providing institutions with an outline of issues to consider without requiring specific approaches.

Although a few commenters believed that the proposed requirement to update the Program was burdensome and should be eliminated, most commenters agreed that the Program should be designed to address changing risks over time. A number of these commenters, however, objected to the requirement that the Program must be designed to address changing identity theft risks “as they arise,” as too burdensome a standard. Instead, they recommended that the final regulations require a financial institution or creditor to reassess periodically whether to adjust the types of accounts covered or Red Flags to be detected based upon any changes in the types and methods of identity theft that an institution or creditor has experienced.

Section _.90(d) of the final rules requires each financial institution or creditor that offers or maintains one or more covered accounts to develop and implement a written Program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. To signal that the final rules are flexible, and allow smaller financial institutions and creditors to tailor their Programs to their operations, the final rules state that the Program must be appropriate to the size and complexity of the financial institution or creditor and the nature and scope of its activities.

The guidelines are appended to the final rules to assist financial institutions and creditors in the formulation and maintenance of a Program that satisfies the requirements of the regulation. Section I of the guidelines, titled “The Program,” makes clear that a covered entity may incorporate into its Program, as appropriate, its existing processes that control reasonably foreseeable risks to customers or to the safety and soundness of the financial institution or creditor from identity theft, such as those already developed in connection with the entity's fraud prevention program. This will avoid duplication and allow covered entities to benefit from existing policies and procedures.

The Agencies do not agree with those commenters who asserted that the scope of the proposed regulations (and hence the final rules that adopt the identical approach with respect to these issues)

exceed the Agencies” statutory mandate. First, section 114 clearly permits the Agencies to issue regulations and guidelines that address more than the mere identification of the risk of identity theft. Section 114 contains a broad mandate directing the Agencies to issue guidelines “regarding identity theft” and to prescribe regulations requiring covered entities to establish reasonable policies and procedures for implementing the guidelines. Second, two provisions in section 114 indicate that Congress expected the Agencies to issue final regulations and guidelines requiring financial institutions and creditors to detect, prevent, and mitigate identity theft.

The first relevant provision is codified in section 615(e)(1)(C) of the FCRA, where Congress addressed a particular scenario involving card issuers. In that provision, Congress directed the Agencies to prescribe regulations requiring a card issuer to take specific steps to assess the validity of a change of address request when it receives such a request and, within a short period of time, also receives a request for an additional or replacement card. The regulations must prohibit a card issuer from issuing an additional or replacement card under such circumstances, unless it notifies the cardholder or “uses other means of assessing the validity of the change of address in accordance with reasonable policies and procedures established by the card issuer in accordance with the regulations prescribed [by the Agencies] * * *.” This provision makes clear that Congress contemplated that the Agencies' regulations would require a financial institution or creditor to have policies and procedures not only to identify Red Flags, but also, to prevent and mitigate identity theft.

The second relevant provision is codified in section 615(e)(2)(B) of the FCRA, and directs the Agencies to consider addressing in the identity theft guidelines transactions that occur with respect to credit or deposit accounts that have been inactive for more than two years. The Agencies must consider whether a creditor or financial institution detecting such activity should “follow reasonable policies that provide for notice to be given to the consumer in a manner reasonably designed to reduce the likelihood of identity theft with respect to such account.” This provision signals that the Agencies are authorized to prescribe regulations and guidelines that comprehensively address identity theft—in a manner that goes beyond the mere identification of possible risks.

The Agencies' interpretation of section 114 is also supported by the legislative history that indicates Congress expected the Agencies to issue regulations and guidelines for the purposes of “identifying and preventing identity theft.”

See

S. Rep. No. 108-166 at 13 (Oct. 17, 2003) (accompanying S. 1753).

Finally, the Agencies' interpretation of section 114 is broad, based on a public policy perspective that regulations and guidelines addressing the identification of the risk of identity theft, without addressing the prevention and mitigation of identity theft, would not be particularly meaningful or effective.

The Agencies also have concluded that the scope of section 114 does not only apply to credit transactions, but also applies, for example, to deposit accounts. Section 114 refers to the risk of identity theft, generally, and not strictly in connection with credit. Because identity theft can and does occur in connection with various types of accounts, including deposit accounts, the final rules address identity theft in a comprehensive manner.

Furthermore, nothing in section 114 indicates that the regulations must only apply to identity theft in connection with account openings. The FTC has defined “identity theft” as “a fraud committed or attempted using the identifying information of another person without authority.”

Such fraud may occur in connection with account openings and with existing accounts. Section 615(e)(3) states that the guidelines that the Agencies prescribe “shall not be inconsistent” with the policies and procedures required under 31 U.S.C. 5318(l), a reference to the CIP rules which require certain financial institutions to verify the identity of customers opening new accounts. However, the Agencies do not read this phrase to prevent them from prescribing rules directed at existing accounts. To interpret the provision in this manner would solely authorize the Agencies to prescribe regulations and guidelines identical to and duplicative of those already issued—making the Agencies' regulatory authority in this area superfluous and meaningless.

16 CFR 603.2(a).

The Agencies' conclusion is also supported by case law interpreting similar terminology, albeit in a different context, finding that “inconsistent” means it is impossible to comply with two laws simultaneously, or one law frustrates the purposes and objectives of another.

See, e.g., Davenport

Farmers Ins. Group,

378 F.3d 839 (8th Cir. 2004);

Retail Credit Co.

Dade County, Florida,

393 F. Supp. 577 (S.D. Fla. 1975);

Alexiou

Brad Benson Mitsubishi,

127 F. Supp.2d 557 (D.N.J. 2000).

The Agencies recognize that requiring a written Program will impose some burden. However, the Agencies believe the benefit of being able to assess a covered entity's compliance with the final rules by evaluating the adequacy and implementation of its written Program outweighs the burdens imposed by this requirement.

Moreover, although the final rules continue to require a written Program, as detailed below, the Agencies have substantially revised the proposal to focus the final rules and guidelines on reasonably foreseeable risks, make the final rules less prescriptive, and provide financial institutions and creditors with more discretion to develop policies and procedures to detect, prevent, and mitigate identity theft.

Proposed § _.90(c) also provided that the Program must address changing identity theft risks as they arise based upon the experience of the financial institution or creditor with identity theft and changes in: Methods of identity theft; methods to detect, prevent, and mitigate identity theft; the types of accounts the financial institution or creditor offers; and its business arrangements, such as mergers and acquisitions, alliances and joint ventures, and service provider arrangements.

The Agencies continue to believe that, to ensure a Program's continuing effectiveness, it must be updated, at least periodically. However, in order to simplify the final rules, the Agencies moved this requirement into the next section, where it is one of the required elements of the Program, as discussed below.

Development and Implementation of Identity Theft Prevention Program

The remaining provisions of the proposed rules were set forth under the above-referenced section heading. Many commenters asserted that the Agencies should simply articulate certain objectives and provide financial institutions and creditors the flexibility and discretion to design policies and procedures to fulfill the objectives of the Program without the level of detail required under this section.

As described earlier, to ensure that financial institutions and creditors are able to design Programs that effectively address identity theft in a manner tailored to their own operations, the Agencies have made significant changes in the proposal by deleting whole provisions or moving them into the guidelines in Appendix J. More specifically, the Agencies abbreviated the proposed requirements formerly located in the provisions titled

“Identification and Evaluation of Red Flags” and “Identity Theft Prevention and Mitigation” and have placed them under a section of the final rules titled “Elements of a Program.” The proposed requirements on “Staff Training,” “Oversight of Service Provider Arrangements,” and “Involvement of Board of Directors and Senior Management” are now in a section of the final rules titled “Administration of the Program.” The guidelines in Appendix J elaborate on these requirements. A discussion of the comments received on these sections of the proposed rules, and the corresponding sections of the final rules and guidelines follows.

Section _.90(d)(2)(i) Element I of the Program: Identification of Red Flags

Proposed § _.90(d)(1)(i) required a Program to include policies and procedures to identify which Red Flags, singly or in combination, are relevant to detecting the possible risk of identity theft to customers or to the safety and soundness of the financial institution or creditor, using the risk evaluation described in § _.90(d)(1)(ii). It also required the Red Flags identified to reflect changing identity theft risks to customers and to the financial institution or creditor as they arise.

Proposed § _.90(d)(1)(i) provided that each financial institution and creditor must incorporate into its Program relevant Red Flags from Appendix J. The preamble to the proposed rules acknowledged that some Red Flags that are relevant today may become obsolete as time passes. The preamble stated that the Agencies expected to update Appendix J periodically,

but that it may be difficult to do so quickly enough to keep pace with rapidly evolving patterns of identity theft or as quickly as financial institutions and creditors experience new types of identity theft. Therefore, proposed § _.90(d)(1)(i) also provided that each financial institution and creditor must incorporate into its Program relevant Red Flags from applicable supervisory guidance, incidents of identity theft that the financial institution or creditor has experienced, and methods of identity theft that the financial institution or creditor has identified that reflect changes in identity theft risks.

Section 114 directs the Agencies to update the guidelines as often as necessary.

See

15 U.S.C. 1681m(e)(1)(a).

Some commenters objected to the proposed requirement that the Program contain policies and procedures to identify which Red Flags, singly or in combination, are relevant to detecting the possible risk of identity theft to customers or to the safety and soundness of the financial institution or creditor. They criticized the phrase “possible risk” as too broad and stated that it was unrealistic to impose upon covered entities a continuing obligation to incorporate into their Programs Red Flags to address virtually any new identity theft incident or trend and potential fraud prevention measure. These commenters stated that this would be a burdensome compliance exercise that would limit flexibility and add costs, which in turn, would take away limited resources from the ultimate objective of combating identity theft.

Many commenters objected to the proposed requirement that the Red Flags identified by a financial institution or creditor reflect changing identity theft risks to customers and to the financial institution or creditor “as they arise.” These commenters requested that the final rules permit financial institutions and creditors a reasonable amount of time to adjust the Red Flags included in their Programs.

Some commenters agreed that the enumerated sources of Red Flags were appropriate. A few commenters stated that financial institutions and creditors should not be required to include in their Programs any Red Flags except for those set forth in Appendix J or in supervisory guidance, or that they had experienced. However, most commenters objected to the requirement that, at a minimum, the Program incorporate any relevant Red Flags from Appendix J.

Some financial institution commenters urged deletion of the proposed requirement to include a list of relevant Red Flags in their Program. They stated that a financial institution should be able to assess which Red Flags are appropriate without having to justify to an examiner why it failed to include a specific Red Flag on a list. Other commenters recommended that the list of Red Flags in Appendix J be illustrative only. These commenters recommended that a financial institution or creditor be permitted to include any Red Flags on its list that it concludes are appropriate. They suggested that the Agencies encourage institutions to review the list of Red Flags, and use their own experience and expertise to identify other Red Flags that become apparent as fraudsters adapt and develop new techniques. They maintained that in this manner, institutions and creditors would be able to identify the appropriate Red Flags and not waste limited resources and effort addressing those Red Flags in Appendix J that were obsolete or not appropriate for their activities.

By contrast, consumer groups criticized the flexibility and discretion afforded to financial institutions and creditors in this section of the proposed rules. These commenters urged the Agencies to make certain Red Flags from Appendix J mandatory, such as a fraud alert on a consumer report.

Proposed § _.90(d)(1)(ii) provided that in order to identify which Red Flags are relevant to detecting a possible risk of identity theft to its customers or to its own safety and soundness, the financial institution or creditor must consider:

A. Which of its accounts are subject to a risk of identity theft;

B. The methods it provides to open these accounts;

C. The methods it provides to access these accounts; and

D. Its size, location, and customer base.

While some industry commenters thought the enumerated factors were appropriate, other commenters stated that the factors on the list were not necessarily the ones used by financial institutions to identify risk and were irrelevant to any determination of identity theft or actual fraud. These commenters maintained that this proposed requirement would require financial institutions to develop entirely new programs that may not be as effective or efficient as those designed by anti-fraud experts. Therefore, they recommended that the final rules provide financial institutions and creditors with wide latitude to determine what factors they should consider and how they categorize them. These commenters urged the Agencies to refrain from providing a list of factors that financial institutions and creditors would have to consider because a finite list could limit their ability to adapt to new forms of identity theft.

Some commenters suggested that the risk evaluation include an assessment of other factors such as the likelihood of harm, the cost and operational burden of using a particular Red Flag and the effectiveness of a particular Red Flag for that institution or creditor. Some commenters suggested that the factors refer to the likely risk of identity theft, while others suggested that the factors be modified to refer to the possible risk of identity theft to which each type of account offered by the financial institution or creditor is subject. Other commenters, including a trade association representing small financial institutions, asked the Agencies to provide guidelines on how to conduct a risk assessment.

The final rules continue to address the identification of relevant Red Flags, but simply state that the first element of a Program must be reasonable policies and procedures to identify relevant Red Flags for the covered accounts that the financial institution or creditor offers or maintains. The final rules also state that a financial institution or creditor must incorporate these Red Flags into its Program.

The final rules do not require policies and procedures for identifying which Red Flags are relevant to detecting a “possible risk” of identity theft. Moreover, as described below, a covered entity's obligation to update its Red Flags is now a separate element of the Program. The section of the proposed rules describing the various factors that a financial institution or creditor must consider to identify relevant Red Flags, and the sources from which a financial institution or creditor must derive its Red Flags, are now in section II of the guidelines titled “ Identifying Relevant Red Flags.”

The Agencies acknowledge that establishing a finite list of factors that a financial institution or creditor must consider when identifying relevant Red Flags for covered accounts could limit the ability of a financial institution or creditor to respond to new forms of identity theft. Therefore, section II of the guidelines contains a list of factors that a financial institution or creditor “should consider * * * as appropriate” in identifying relevant Red Flags.

The Agencies also modified the list in order to provide more appropriate examples of factors for consideration by a financial institution or creditor determining which Red Flags may be relevant. These factors are:

• The types of covered accounts it offers or maintains;

• The methods it provides to open its covered accounts;

• The methods it provides to access its covered accounts; and

• Its previous experiences with identity theft.

Thus, for example, Red Flags relevant to deposit accounts may differ from those relevant to credit accounts, and those applicable to consumer accounts may differ from those applicable to business accounts. Red Flags appropriate for accounts that may be opened or accessed remotely may differ from those that require face-to-face contact. In addition, a financial institution or creditor should consider identifying as relevant those Red Flags that directly relate to its previous experiences with identity theft.

Section II of the guidelines also gives examples of sources from which financial institutions and creditors should derive relevant Red Flags, rather than requiring that the Program incorporate relevant Red Flags strictly from the four sources listed in the proposed rules. Section II states that a financial institution or creditor should incorporate into its Program relevant Red Flags from sources such as: (1) Incidents of identity theft that the financial institution or creditor has experienced; (2) methods of identity theft that the financial institution or creditor has identified that reflect changes in identity theft risks; and (3) applicable supervisory guidance.

The Agencies have deleted the reference to the Red Flags in Appendix J as a source. Instead, a separate provision in section II of the guidelines, titled “Categories of Red Flags,” states that the Program of a financial institution or creditor “should include” relevant Red Flags from five particular categories “as appropriate.” The Agencies have included these categories, which summarize the various types of Red Flags that were previously enumerated in Appendix J, in order to provide additional non-prescriptive guidance regarding the identification of relevant Red Flags.

Section II of the guidelines also notes that “examples” of individual Red Flags from each of the five categories are appended as Supplement A to Appendix J. The examples in Supplement A are a list of Red Flags similar to those found in the proposed rules. The Agencies did not intend for these examples to be a comprehensive list of all types of identity theft that a financial institution or creditor may experience. When identifying Red Flags, financial institutions and creditors must consider the nature of their business and the type of identity theft to which they may be subject. For instance, creditors in the health care field may be at risk of medical identity theft (

i.e.

, identity theft for the purpose of obtaining medical services) and, therefore, must identify Red Flags that reflect this risk.

The Agencies also have decided not to single out any specific Red Flags as mandatory for all financial institutions and creditors. Rather, the final rule continues to follow the risk-based, non-prescriptive approach regarding the identification of Red Flags that was set forth in the proposal. The Agencies recognize that the final rules and guidelines cover a wide variety of financial institutions and creditors that offer and maintain many different products and services, and require the flexibility to be able to adapt to rapidly changing risks of identity theft.

Sections _.90(d)(2)(ii) and (iii) Elements II and III of the Program: Detection of and Response to Red Flags

Proposed § _.90(d)(2) stated that the Program must include reasonable policies and procedures designed to prevent and mitigate identity theft in connection with the opening of an account or any existing account. This section then described the policies and procedures that the Program must include, some of which related solely to account openings while others related to existing accounts.

Some financial institution commenters acknowledged that reference to prevention and mitigation of identity theft was generally a good objective, but they urged that the final rules refrain from prescribing how financial institutions must achieve it. Others noted that the CIP rules and the Information Security Standards already required many of the steps in the proposal. They recommended that the final rules recognize this and clarify that compliance with parallel requirements would be sufficient for compliance under these rules.

Section _.90(d)(1) of the final rules requires financial institutions and creditors to develop and implement a written Program to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. Therefore, the Agencies concluded that it was not necessary to reiterate this requirement in § _.90(d)(2). The Agencies have deleted the prefatory language from proposed § _.90(d)(2) on prevention and mitigation in order to streamline the final rules. The various provisions addressing prevention and mitigation formerly in this section, namely, verification of identity, detection of Red Flags, assessment of the risk of Red Flags, and responses to the risk of identity theft, have been incorporated into the final rules as “Elements of the Program” and into the guidelines elaborating on these provisions. Comments received regarding these provisions and the manner in which they have been integrated into the final rules and guidelines follows.

Detecting Red Flags

Proposed § _.90(d)(2)(i) stated that the Program must include reasonable policies and procedures to obtain identifying information about, and verify the identity of, a person opening an account. This provision was designed to address the risk of identity

theft to a financial institution or creditor that occurs in connection with the opening of new accounts.

The proposed rules stated that any financial institution or creditor would be able to satisfy the proposed requirement in § _.90(d)(2)(i) by using the policies and procedures for identity verification set forth in the CIP rules. The preamble to the proposed rules explained that although the CIP rules exclude a variety of entities from the definition of “customer” and exclude a number of products and relationships from the definition of “account,”

the Agencies were not proposing any exclusions from either of these terms given the risk-based nature of the regulations.

See, e.g.

, 31 CFR 103.121(a).

Most commenters supported this provision. Many of these commenters urged the Agencies to include in the final rules a clear statement acknowledging that financial institutions and creditors complying with the CIP rules would be deemed to be in compliance with this provision's requirements. Some of these commenters encouraged the Agencies to place the exemptions from the CIP rules in these final rules for consistency in implementing both regulatory mandates.

Some commenters, however, believed the requirement to verify the identity of a person opening an account duplicated the requirements in the CIP rules and urged elimination of this redundancy. Other entities not already subject to the CIP rules stated that complying with those rules would be very costly and burdensome. These commenters asked that the Agencies provide them with additional guidance regarding the CIP rules.

Consumer groups were concerned that use of the CIP rules would not adequately address identity theft. They stated that the CIP rules allow accounts to be opened before identity is verified, which is not the proper standard to prevent identity theft.

As described below, the Agencies have moved verification of the identity of persons opening an account into section III of the guidelines where it is described as one of the policies and procedures that a financial institution or creditor should have to detect Red Flags in connection with the opening of a covered account.

Proposed § _.90(d)(2)(ii) stated that the Program must include reasonable policies and procedures to detect the Red Flags identified pursuant to paragraph § _.90(d)(1). The Agencies did not receive any specific comments on this provision.

In the final rules, the detection of Red Flags is the second element of the Program. The final rules provide that a Program must contain reasonable policies and procedures to detect the Red Flags that a financial institution or creditor has incorporated into its Program.

Section III of the guidelines provides examples of various means to detect Red Flags. It states that the Program's policies and procedures should address the detection of Red Flags in connection with the opening of covered accounts, such as by obtaining identifying information about, and verifying the identity of, a person opening a covered account, for example, using the policies and procedures regarding identification and verification set forth in the CIP rules. Section III also states that the Program's policies and procedures should address the detection of Red Flags in connection with existing covered accounts, such as by authenticating customers, monitoring transactions, and verifying the validity of change of address requests, in the case of existing covered accounts.

Covered entities subject to the CIP rules, the Federal Financial Institution's Examination Council's guidance on authentication,

the Information Security Standards, and Bank Secrecy Act (BSA) rules

may already be engaged in detecting Red Flags. These entities may wish to integrate the policies and procedures already developed for purposes of complying with these issuances into their Programs. However, such policies and procedures may need to be supplemented. For example, the CIP rules were written to implement section 326

of the USA PATRIOT Act,

an Act directed toward facilitating the prevention, detection, and prosecution of international money laundering and the financing of terrorism. Certain types of “accounts,” “customers,” and products are exempted or treated specially in the CIP rules because they pose a lower risk of money laundering or terrorist financing. Such special treatment may not be appropriate to accomplish the broader objective of detecting, preventing, and mitigating identity theft. Accordingly, the Agencies expect all financial institutions and creditors to evaluate the adequacy of existing policies and procedures and to develop and implement risk-based policies and procedures that detect Red Flags in an effective and comprehensive manner.

“Authentication in an Internet Banking Environment” (October 12, 2005) available at

http://www.ffiec.gov/press/pr101205.htm.

See, e.g.

12 CFR 21.21 (national banks); 12 CFR 208.63 (state member banks); 12 CFR 326.8 (state non-member banks); 12 CFR 563.177 (savings associations); and 12 CFR 748.2 (credit unions).

31 U.S.C. 5318(l).

Pub. L. 107-56.

Responding to Red Flags

Proposed § _.90(d)(2)(iii) stated that to prevent and mitigate identity theft, the Program must include policies and procedures to assess whether the Red Flags the financial institution or creditor detected pursuant to proposed § _.90(d)(2)(ii) evidence a risk of identity theft. It also stated that a financial institution or creditor must have a reasonable basis for concluding that a Red Flag (detected) does not evidence a risk of identity theft.

Financial institution commenters expressed concern that this standard would force an institution to justify to examiners why it did not take measures to respond to a particular Red Flag. Some consumer groups believed it was appropriate to require a financial institution or creditor to have a reasonable basis for concluding that a particular Red Flag detected does not evidence a risk of identity theft. Other consumer groups believed that this was too weak a standard and that mandating the detection of certain Red Flags would be more effective and preventive.

Some commenters mistakenly read the proposed provision as requiring a financial institution or creditor to have a reasonable basis for excluding a Red Flag listed in Appendix J from its Program requiring the mandatory review and analysis of each and every Red Flag. These commenters urged the Agencies to delete this provision.

Proposed § _.90(d)(2)(iv) stated that to prevent and mitigate identity theft, the Program must include policies and procedures that address the risk of identity theft to the customer, the financial institution, or creditor, commensurate with the degree of risk posed. The proposed regulations also provided an illustrative list of measures that a financial institution or creditor could take, including:

• Monitoring an account for evidence of identity theft;

• Contacting the customer;

• Changing any passwords, security codes, or other security devices that permit access to a customer's account;

• Reopening an account with a new account number;

• Not opening a new account;

• Closing an existing account;

• Notifying law enforcement and, for those that are subject to 31 U.S.C. 5318(g), filing a Suspicious Activity Report in accordance with applicable law and regulation;

• Implementing any requirements regarding limitations on credit extensions under 15 U.S.C. 1681c-1(h), such as declining to issue an additional credit card when the financial institution or creditor detects a fraud or active duty alert associated with the opening of an account, or an existing account; or

• Implementing any requirements for furnishers of information to consumer reporting agencies under 15 U.S.C. 1681s-2, to correct or update inaccurate or incomplete information.

Some commenters agreed that financial institutions and creditors should be able to use their own judgment to determine which measures to take depending upon the degree of risk that is present. However, consumer groups believed that the final rules should require notification of consumers in every case where a Red Flag that requires a response has been detected.

Other commenters objected to some of the examples given as measures that financial institutions and creditors could take to address the risk of identity theft. For example, one commenter objected to the inclusion, as an example, of the requirements regarding limitations on credit extensions under 15 U.S.C. 1681c-1(h). The commenter stated that this statutory provision is confusing, useless, and should not be referenced in the final rules. Other commenters suggested that the Agencies clarify that the inclusion of this statutory provision in the proposed rules as an example of how to address the risk of identity theft did not make this provision discretionary.

The final rules merge the concepts previously in proposed § _.90(d)(2)(iii) and § _.90(d)(2)(iv) into the third element of the Program: reasonable policies and procedures to respond appropriately to any Red Flags that are detected pursuant to paragraph (d)(2)(ii) of this section to prevent and mitigate identity theft.

In order to “respond appropriately,” it is implicit that a financial institution or creditor must assess whether the Red Flags detected evidence a risk of identity theft, and must have a reasonable basis for concluding that a Red Flag does not evidence a risk of identity theft. Therefore, the Agencies concluded that it is not necessary to specify any such separate assessment, and, accordingly, deleted the language from the proposal regarding assessing Red Flags and addressing the risk of identity theft.

Most of the examples of measures for preventing and mitigating identity theft previously listed in proposed § _.90(d)(2)(iv) are now located in section IV of the guidelines, titled “Prevention and Mitigation of Identity Theft.” Section IV states that the Program's policies and procedures should provide for appropriate responses to the Red Flags the financial institution or creditor has detected that are commensurate with the degree of risk posed. In addition, as described earlier, the final rules do not define Red Flags to include indicators of a “possible risk” of identity theft (including “precursors” to identity theft). Instead, section IV states that in determining an appropriate response, a financial institution or creditor should consider aggravating factors that may heighten the risk of identity theft, and provides examples of such factors.

The Agencies also modified the examples of appropriate responses as follows. First, the Agencies added “not attempting to collect on a covered account or not selling a covered account to a debt collector” as a possible response to Red Flags detected. Second, the Agencies added “determining that no response is warranted under the particular circumstances” to make clear that an appropriate response may be no response, especially, for example, when a financial institution or creditor has a reasonable basis for concluding that the Red Flags detected do not evidence a risk of identity theft.

In addition, the Agencies moved the proposed examples, that referenced responses mandated by statute, to section VII of the guidelines titled “Other Applicable Legal Requirements” to highlight that certain responses are legally required.

The section of the proposal listing examples of measures to address the risk of identity theft included a footnote that discussed the relationship between a consumer's placement of a fraud or active duty alert on his or her consumer report and ECOA, 15 U.S.C. 1691,

et seq.

A few commenters objected to this footnote. Some commenters believed that creditors had a right to deny credit automatically whenever a fraud or active duty alert appears on the consumer report of an applicant. Other commenters believed that the footnote raised complex issues under the ECOA and FCRA that required more thorough consideration, and questioned the need and appropriateness of addressing ECOA in the context of this rulemaking.

Under ECOA, it is unlawful for a creditor to discriminate against any applicant for credit because the applicant has in good faith exercised any right under the Consumer Credit Protection Act (CCPA), 15 U.S.C. 1691(a). A consumer who requests the inclusion of a fraud alert or active duty alert in his or her credit file is exercising a right under the FCRA, which is a part of the CCPA, 15 U.S.C. 1601,

et seq.

When a credit file contains a fraud or active duty alert, section 605A of the FCRA, 15 U.S.C. 1681c-1(h), requires a creditor to take certain steps before extending credit, increasing a credit limit, or issuing an additional card on an existing credit account. For an initial or active duty alert, these steps include utilizing reasonable policies and procedures to form a reasonable belief that the creditor knows the identity of the consumer and, where a consumer has specified a telephone number for identity verification purposes, contacting the consumer at that telephone number or taking reasonable steps to verify the consumer's identity and confirm that the application is not the result of identity theft, 15 U.S.C. 1681c-1(h)(1)(B).

The purpose of the footnote was to remind financial institutions and creditors of their legal responsibilities in circumstances where a consumer has placed a fraud or active duty alert on his or her consumer report. In particular, the Agencies have concerns that in some cases, creditors have adopted policies of automatically denying credit to consumers whenever an initial fraud alert or an active duty alert appears on an applicant's consumer report. The Agencies agree that this rulemaking is not the appropriate vehicle for addressing issues under ECOA. However, the Agencies will continue to evaluate compliance with ECOA through their routine examination or enforcement processes, including issues related to fraud and active duty alerts.

Section _.90(d)(2)(iv) Element IV of the Program: Updating the Program

To ensure that the Program of a financial institution or creditor remains effective over time, the final rules provide a fourth element of the Program: policies and procedures to ensure the Program (including the Red Flags determined to be relevant) is updated periodically to reflect changes in risks to customers and to the safety and soundness of the financial institution or creditor from identity theft. As described earlier, this element replaces the requirements formerly in proposed § _.90(c)(2) which stated that the Program must be designed to address changing identity theft risks as they arise, and proposed § _.90(d)(1)(i) which stated that the Red Flags included in a covered entity's Program must reflect changing identity theft risks to customers and to the financial institution or creditor as they arise.

Unlike the proposed provisions, however, this element only requires “periodic” updating. The Agencies concluded that requiring financial institutions and creditors to immediately and continuously update their Programs would be overly burdensome.

Section V of the guidelines elaborates on the obligation to ensure that the Program is periodically updated. It reiterates the factors previously in proposed § _.90(c)(2) that should cause a financial institution or creditor to update its Program, such as its own experiences with identity theft, changes in methods of identity theft, changes in methods to detect, prevent and mitigate identity theft, changes in accounts that it offers or maintains, and changes in its business arrangements.

Section _.90(e) Administration of the Program

The final rules group the remaining provisions of the proposed rules under the heading “Administration of the Program,” albeit in a different order than proposed. This section of the final rules describes the steps that financial institutions and creditors must take to administer the Program, including: Obtaining approval of the initial written Program; ensuring oversight of the development, implementation and administration of the Program; training staff; and overseeing service provider arrangements.

A number of commenters criticized each of the proposed provisions regarding administration of the Program, arguing they were not specifically required by section 114. The Agencies believe the mandate in section 114 is broad, and provides the Agencies with an ample basis to issue rules and guidelines containing these provisions because they are critical to ensuring the effectiveness of a Program. Therefore, the Agencies have retained these elements in the final rules and guidelines with some modifications, as follows.

Sections _.90(e)(1) and (2) Involvement of the Board of Directors and Senior Management

Proposed § _.90(d)(5) highlighted the responsibility of the board of directors and senior management to develop, implement, and oversee the Program. Proposed § _.90(d)(5)(i) specifically required the board of directors or an appropriate committee of the board to approve the written Program. Proposed § _.90(d)(5)(ii) required that the board, an appropriate committee of the board, or senior management be charged with overseeing the development, implementation, and maintenance of the Program, including assigning specific responsibility for its implementation. The proposal also provided that persons charged with overseeing the Program must review reports prepared at least annually by staff regarding compliance by the financial institution or creditor with the regulations.

Proposed § _.90(d)(5)(iii) stated that reports must discuss material matters related to the Program and evaluate issues such as: The effectiveness of the policies and procedures of the financial institution or creditor in addressing the risk of identity theft in connection with the opening of accounts and with respect to existing accounts; service provider arrangements; significant incidents involving identity theft and management's response; and recommendations for changes in the Program.

Some commenters agreed that identity theft is an important issue, and the board, therefore, should be involved in the overall development, approval, and oversight of the Program. These commenters suggested that the final rules make clear that the board need not be responsible for the day-to-day operations of the Program.

Most industry commenters opposed the proposed requirement that the board or board committee approve the Program and receive annual reports about compliance with the Program. These commenters asserted that the statute does not mandate such requirements, and that compliance with these rules did not warrant more board attention than other regulations. They asserted that such requirements would impede the ability of a financial institution or creditor to keep up with the fast-paced changes and developments inherent with instances of fraud and identity theft. They stated that boards of directors should not be required to consider the minutiae of the fraud prevention efforts of a financial institution or creditor and suggested the task be delegated to senior management with expertise in this area. Some commenters suggested the final rules provide a covered entity with the discretion to assign oversight responsibilities in a manner consistent with the institution's own risk evaluation.

One commenter suggested that the final rules permit the board of directors of a holding company to approve and oversee the Program for the entire organization. The commenter explained that this approach would eliminate the need for redundant actions by a multiplicity of boards, and help to insure uniformity of policy throughout large organizations.

Some commenters stated that the preparation of reports for board review would be costly and burdensome. The SBA suggested that the FTC consider a one-page certification option for small low-risk entities to minimize the burden of reports. One commenter opined that it would be sufficient if the Agencies mandated that covered entities continuously review and evaluate the policies and procedures they adopted pursuant to the regulations and modify them as necessary. Consumer groups suggested that the final rules specifically require financial institutions and creditors to adjust their Programs to address deficiencies raised by their annual reports.

Commenters generally took the position that reports to the board, a board committee, or senior management regarding compliance with the final rules should be prepared at most on a yearly basis, or when significant changes have occurred that alter the institution's risk. One commenter recommended a clarification that any reporting to the board of material information relating to the Program could be combined with reporting obligations required under the Information Security Standards.

Section _.90(e)(1) of the final rules continues to require approval of the written Program by the board of directors or an appropriate committee of the board. However, to ensure that this requirement does not hamper the ability of a financial institution or creditor to update its Program in a timely manner, the final rules provide that the board or an appropriate committee must approve only the initial written Program. Thereafter, at the discretion of the covered entity, the board, a committee, or senior management may update the Program.

Bank holding companies and their bank and non-bank subsidiaries will be governed by the principles articulated in connection with the banking agencies” Information Security Standards:

The Agencies agree that subsidiaries within a holding company can use the security program developed at the holding company level. However, if subsidiary institutions choose to use a security program developed at the holding company level, the board of directors or an appropriate committee at each subsidiary institution must conduct an independent review to ensure that the program is suitable and complies with the requirements prescribed by the subsidiary's primary regulator * * * .

66 FR 8620 (Feb. 1, 2001) (Preamble to final Information Security Standards.)

The Agencies recognize that boards of directors have many responsibilities and it generally is not feasible for a board to involve itself in the detailed oversight, development, implementation, and administration of the Program. Accordingly, § _.90(e)(2) of the final rules provides discretion to a financial institution or creditor to determine who will be responsible for these aspects of the Program. It states that a financial institution or creditor must involve the board of directors, an appropriate committee thereof, or a designated employee at the level of senior management in the oversight, development, implementation, and administration of the Program.

Section VI of the guidelines elaborates on this provision of the final rules. The guidelines note that such oversight should include assigning specific responsibility for the Program's implementation and reviewing reports prepared by staff on compliance by the financial institution or creditor with this section. As suggested by commenters, the guidelines also state that oversight should include approving material changes to the Program as necessary to address changing identity theft risks. Section VI also provides that reports should be prepared at least annually and describes the contents of a report as proposed in § _.90(d)(5)(iii)(B).

These steps are modeled on sections of the Information Security Standards.

As noted previously, financial institutions and creditors subject to these Standards may combine elements required under the final rules and guidelines, including reports, with those required by the Standards, as they see fit.

A board approval requirement is also found in the BSA rules of the Federal banking agencies and the NCUA.

See

12 CFR 21.21; (OCC); 12 CFR 208.63 (Board); 12 CFR 326.8 (FDIC); 12 CFR 563.177 (OTS); and 12 CFR 748.2 (NCUA). Thus, contrary to the assertion of some commenters, this rule is being treated in a manner similar to other rules.

Section _.90(e)(3) Staff Training

Proposed § _.90(d)(3) required each financial institution or creditor to train staff to implement its Program.

Consumer groups believed that this provision should be more detailed and specifically require monitoring, oversight, and auditing of a covered entity's training efforts. By contrast, a number of industry commenters recommended that the Agencies withdraw this provision because they believed it was burdensome. Some of these commenters asserted that the Agencies had not taken into account the limited personnel and resources available to smaller institutions to provide training.

Some financial institution commenters stated that it was not clear why staff training would be specifically required under the final rules, absent a specific statutory requirement. They maintained that financial institutions have sufficient incentives to ensure that appropriate staff is trained. Other commenters suggested that the Agencies clarify that this provision would only require training for relevant staff and would permit training on identity theft that is integrated into overall staff training on similar or overlapping matters such as fraud prevention.

One commenter objected to an example in the preamble to the proposed rules which stated that staff should be trained to detect “anomalous wire transfers in connection with a customer's deposit account.” The commenter stated that this example potentially exposed financial institutions to significant and unintended liability, predicting that customers and law enforcement would use the rules to support claims that financial institutions are responsible for authorizing transactions by fraudsters. The commenter asserted that financial institutions do not have systems that can detect these transactions because they fall outside the usual fraud filter parameters.

Section _.90(e)(3) of the final rules provides that a covered entity must train staff, as necessary, to effectively implement the Program. There is no corresponding section of the guidelines.

The Agencies continue to believe proper training will enable staff to address the risk of identity theft. However, this provision requires training of only relevant staff. In addition, staff that has already been trained, for example, as a part of the anti-fraud prevention efforts of the financial institution or creditor, do not need to be re-trained except “as necessary.”

The Agencies recognize that some of the examples, such as detecting “anomalous wire transfers in connection with a customer's deposit account” may fall outside the usual fraud filter parameters. However, the Agencies expect that compliance with the final rules will improve the ability of financial institutions and creditors to detect, prevent, and mitigate identity theft.

Section _.90(e)(4) Oversight of Service Provider Arrangements

Proposed § _.90(d)(4) stated that, whenever a financial institution or creditor engaged a service provider to perform an activity on its behalf and the requirements of the Program applied to that activity, the financial institution or creditor would be required to take steps designed to ensure the activity is conducted in compliance with a Program that satisfies the regulations. The preamble to the proposed rules explained that this provision would allow a service provider serving multiple financial institutions and creditors to conduct activities on behalf of these entities in accordance with its own program to prevent identity theft, as long as the program meets the requirements of the regulations. The service provider would not need to apply the particular Program of each individual financial institution or creditor to whom it is providing services.

Several commenters asserted it would be costly and burdensome for financial institutions and creditors to ensure third party compliance with the final rules and therefore, this provision should be eliminated. They urged that financial institutions and creditors be given maximum flexibility to manage service provider relationships.

Some financial institution commenters also suggested that the Agencies withdraw this provision. They stated that the FACT Act does not address this issue and asserted that there already is no doubt that if a financial institution delegates any of its operations to a third party, the institution will remain responsible for related regulatory compliance.

Other commenters stated that it should remain a contractual matter between the parties whether the service provider may implement a program that is different from its financial institution client.

Consumer groups asked the Agencies to ensure that the decision of a financial institution or creditor to outsource would not lead to lower Red Flag standards. These commenters suggested the final rules state that the Program must also meet the requirements that would apply if the activity were performed without the use of a service provider. They also suggested the final rules clarify that, in addition to any responsibility on the service provider imposed by law, regulation, or contract, the financial institution or creditor would be responsible for a failure to comply with the Program.

Most commenters, however, agreed with the proposal and stated that a service provider must have the flexibility to meet the objectives of the rules without having to tailor its services to the Program requirements of each company for which it provides

service. These commenters noted that this proposed approach was the same as that used in the Information Security Standards.

The Agencies believe it is important to retain a provision in the final rules addressing service providers to remind financial institutions and creditors that they continue to remain responsible for compliance with the final rules, even if they outsource operations to a third party. However, the Agencies have simplified the service provider provision in the final rules and moved the remaining parts of proposed § _.90(d)(4) to the guidelines.

Section _.90(e)(4) of the final rules provides that a covered entity must exercise appropriate and effective oversight of service provider arrangements, without further elaboration. This provision provides maximum flexibility to financial institutions and creditors in managing their service provider arrangements, while making clear that a covered entity cannot escape its obligations to comply with the final rules and to include in its Program those guidelines that are appropriate by simply outsourcing an activity.

Section VI(c) of the guidelines provides that, whenever a financial institution or creditor engages a service provider to perform an activity in connection with one or more covered accounts, the financial institution or creditor should take steps to ensure that the activity of the service provider is conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft. Thus, the guidelines make clear that a service provider that provides services to multiple financial institutions and creditors may do so in accordance with its own program to prevent identity theft, as long as the program meets the requirements of the regulations. The guidelines also provide an example of how a covered entity may comply with this provision. The guidelines state that a financial institution or creditor could require the service provider, by contract, to have policies and procedures to detect relevant Red Flags that may arise in the performance of the service provider's activities and either report the Red Flags to the financial institution or creditor or take appropriate steps to prevent or mitigate identity theft.

Section _.90(f) Consideration of Guidelines in Appendix J

The Agencies have added a provision to the final rules that explains the relationship of the rules to the guidelines. Section _.90(f) states that each financial institution or creditor that is required to implement a Program must consider the guidelines in Appendix J and include in its Program those guidelines that are appropriate.

Each of the guidelines corresponds to a provision of the final rules. As mentioned earlier, the guidelines were issued to assist financial institutions and creditors in the development and implementation of a Program that satisfies the requirements of the final rules. The guidelines provide policies and procedures that financial institutions and creditors should use, where appropriate, to satisfy the regulatory requirements of the final rules. While an institution or a creditor may determine that a particular guideline is not appropriate for its circumstances, it nonetheless must ensure its Program contains reasonable policies and procedures to fulfill the requirements of the final rules. This approach provides financial institutions and creditors with the flexibility to determine “how best to develop and implement the required policies and procedures.”

See

H.R. Rep. No. 108-263 at 43 (Sept. 4, 2003) (accompanying H.R. 2622); S. Rep. No. 108-166 at 13 (Oct. 17, 2003) (accompanying S. 1753).

Supplement A to Appendix J: Examples of Red Flags

Section 114 of the FACT Act states that, in developing the guidelines, the Agencies must identify patterns, practices, and specific forms of activity, that indicate the possible existence of identity theft. The Agencies proposed implementing this provision by requiring the Program of a financial institution or creditor to include policies and procedures for the identification and detection of Red Flags in connection with an account opening or an existing account, including from among those listed in Appendix J.

The Agencies compiled the Red Flags enumerated in Appendix J from a variety of sources, such as literature on the topic, information from credit bureaus, financial institutions, creditors, designers of fraud detection software, and the Agencies' own experiences. The preamble to the proposed rules stated that some of the Red Flags, by themselves, may be reliable indicators of identity theft, while others are more reliable when detected in combination with other Red Flags.

The preamble to the proposed rules explained that the Agencies recognized that a wide range of financial institutions and creditors, and a broad variety of accounts would be covered by the regulations. Therefore, the Agencies proposed to afford each financial institution and creditor flexibility to determine which Red Flags were relevant for their purposes to detect identity theft, including from among those listed in Appendix J.

As mentioned previously, consumer groups criticized the discretion in the proposal that permitted financial institutions and creditors to choose Red Flags relevant to detecting the risk of identity theft based upon the list of enumerated factors. These groups urged the Agencies to make certain Red Flags in Appendix J mandatory. In addition, consumer groups suggested a number of additional Red Flags for inclusion in Appendix J.

Some commenters agreed that the list of examples of Red Flags was appropriate because, in their view, it was designed to be flexible. Some industry commenters, including a number of small financial institutions, stated that the Red Flags set forth in Appendix J would assist them in developing and improving their identity theft prevention programs. Other commenters suggested deleting the list of Red Flags or modifying the list in a manner appropriate to the nature of their own operations.

The Agencies have retained the list of examples of Red Flags because section 114 states that the Agencies “shall identify patterns, practices, and specific forms of activity that indicate the possible existence of identity theft.” The Agencies also retained the list because some commenters indicated that having examples of Red Flags would be helpful to them. However, the examples of Red Flags are now set forth in a separate supplement to the guidelines. The list of examples is similar to that which the Agencies proposed, however, the Red Flags that the Agencies identified as precursors to identity theft have been deleted and are now addressed in section IV of the guidelines. Moreover, in response to a Congressional commenter, the Agencies added, as an example of a Red Flag, an application that gives the appearance of having been destroyed and reassembled.

The introductory language to the supplement clarifies that the enumerated Red Flags are examples. Thus, a financial institution or creditor may tailor the Red Flags it chooses for its Program to its own operations. A financial institution or creditor will not need to justify to an Agency its failure to include in the Program a specific Red Flag from the list of examples. However, a covered entity will have to account for the overall effectiveness of a Program that is appropriate to its size and

complexity and the nature and scope of its activities.

Inactive Accounts

Section 114 also directs the Agencies to consider whether to include reasonable guidelines for notifying the consumer when a transaction occurs in connection with a consumer's credit or deposit account that has been inactive for two years, in order to reduce the likelihood of identity theft. The preamble to the proposed rules noted that the Agencies believed that the two-year limit was not always an accurate indicator of identity theft given the wide variety of credit and deposit accounts that would be covered by the provision. Therefore, in place of guidelines on inactive accounts, the Agencies proposed incorporating a Red Flag on inactive accounts into Appendix J that was flexible and was designed to take into consideration the type of account, the expected pattern of usage of the account, and any other relevant factors.

Some consumer groups suggested that a new section be added to the guidelines requiring notice to the consumer when a transaction occurs in connection with a consumer's credit or deposit account that has been inactive for two years unless this pattern would be expected for a particular type of account. Other commenters agreed with the Agencies' proposal to simply make activity on an inactive account a Red Flag. They also agreed that the Agencies should not use two years of inactivity as a hard and fast rule, and allow financial institutions and creditors to use their own standards to determine when an account is inactive.

In the final rules, the Agencies continue to list activity on an inactive account as a Red Flag. Given the variety of covered accounts to which the final rules and guidelines will apply, the Agencies concluded that the two-year period suggested in section 114 would not necessarily be a useful indicator of identity theft. Therefore, the Agencies have not included a provision in the guidelines regarding notification when a transaction occurs in connection with a consumer's credit or deposit account that has been inactive for two years.

B. Special Rules for Card Issuers

1. Background

Section 114 also requires the Agencies to prescribe joint regulations generally requiring credit and debit card issuers to assess the validity of change of address notifications. In particular, these regulations must ensure that if the card issuer receives a notice of change of address for an existing account and, within a short period of time (during at least the first 30 days), receives a request for an additional or replacement card for the same account, the issuer must follow reasonable policies and procedures to assess the validity of the change of address through one of three methods. The card issuer may not issue the card unless it: (1) Notifies the cardholder of the request at the cardholder's former address and provides the cardholder with a means to promptly report an incorrect address; (2) notifies the cardholder of the address change request by another means of communication previously agreed to by the issuer and the cardholder; or (3) uses other means of evaluating the validity of the address change in accordance with the reasonable policies and procedures established by the card issuer to comply with the joint regulations described earlier regarding identity theft.

For this reason, the Agencies also proposed special rules that required credit and debit card issuers to assess the validity of change of address notifications by notifying the cardholder or through certain other means. The proposed regulations stated that a financial institution or creditor that is a card issuer may incorporate the requirements of § _.91 into its Program.

As described in the section-by-section analysis that follows, commenters generally requested changes that would make the proposed rules more flexible.

2. Section-by-Section Analysis

Section _.91(a) Scope

The proposed rules stated that this section applies to a person, described in proposed § _.90(a), that issues a debit or credit card. The Agencies did not receive any comments on this section.

In the final rules, for clarity, the Agencies deleted the cross-reference to § _.90(a). Each Agency also revised its scope paragraph to list the entities over which it has jurisdiction that are subject to § _.91. Under the final rules, section _.91 applies to any debit or credit card issuer (card issuer) that is subject to an Agency's jurisdiction.

Section _.91(b) Definitions

The proposed rules included two definitions solely applicable to the special rules for card issuers: “cardholder” and “clear and conspicuous.” Section _.91(b) of the final rules also contains these definitions as follows.

Section _.91(b)(1) Cardholder

Under section 114, the Agencies must prescribe regulations requiring a card issuer to follow reasonable policies and procedures to assess the validity of a change of address, before issuing an additional or replacement card. Section 114 provides that a card issuer may satisfy this requirement by notifying “the cardholder.” The term “cardholder” is not defined in the FACT Act. The preamble to the proposed rules explained that the legislative record relating to this provision indicates that “issuers of credit cards and debit cards who receive a

consumer

request for an additional or replacement card for an existing account” may assess the validity of the request by notifying “the cardholder.”

As the preamble noted, the request, presumably, will be valid if the consumer making the request and the cardholder are one and the same “consumer.” Therefore, the proposal defined “cardholder” as a consumer who has been issued a credit or debit card. The preamble to the proposed rules also explained that, because “consumer” is defined in the FCRA as an “individual,”

the proposed regulations applied to any request for an additional or replacement card by an individual, including a card for a business purpose, such as a corporate card.

See

149 Cong. Rec. E2513 (daily ed. December 8, 2003) (statement of Rep. Oxley) (emphasis added).

15 U.S.C. 1681a(c).

Some commenters asked the Agencies to clarify that this definition does not apply to holders of stored value cards, such as payroll and gift cards, or to cards used to access a home equity line of credit. Another commenter urged that the final rules exclude credit and debit cards for a business purpose.

The final rules continue to define “cardholder” as a consumer who has been issued a credit or debit card. Both “credit card” and “debit card” are defined in section 603(r) of the FCRA.

The definition of “credit card” is defined by cross-reference to section 103 of the Truth in Lending Act, 15 U.S.C. 1601,

et seq.

The definition of “debit card” is any card issued by a financial institution to a consumer for use in initiating an electronic fund transfer from the account of the consumer at such financial institution for the purposes of transferring money between accounts or obtaining money, property, labor, or services.

15 U.S.C. 1681a.

See

15 U.S.C. 1681a(r)(2).

15 U.S.C. 1681a(r)(3).

Section 603(r) of the FCRA provides that “account” and “electronic fund transfer” have the same meaning as those terms have in the Electronic Funds Transfer Act (EFTA), 15 U.S.C.

1693,

et seq.

The EFTA, and Regulation E, 12 CFR part 205, govern electronic fund transfers. In contrast to section 603(r) of the FCRA, neither the EFTA nor Regulation E defines the term “debit card.” Instead, coverage under the EFTA and Regulation E depends upon whether electronic fund transfers can be made to or from an “account,” meaning a checking, savings, or other consumer asset account established primarily for personal, family or household purposes. The Board recently issued a final rule expanding the definition of “account” under Regulation E to cover payroll card accounts.

Therefore, a holder of a payroll card is a “cardholder” for purposes of § _.91(b)(1), provided that the card issuer is a “financial institution” as defined in section 603(t) of the FCRA.

See

71 FR 51,437 (August 10, 2006).

The Board decided not to cover other types of prepaid cards as accounts under Regulation E at the time it issued the payroll card rule. Therefore, the definition of “cardholder” does not include the holder of a gift card or other prepaid card product, unless and until the Board elects to cover such cards as accounts under Regulation E.

The definition of “cardholder” would also include a recipient of a home equity loan if the holder is able to access the proceeds of the loan with a credit or debit card within the meaning of 15 U.S.C. 1681a(r).

Identity theft may occur in connection with a card that a consumer uses for a business purpose and may affect the consumer's personal credit standing. Additionally, the definition of “consumer” under the FCRA is simply an “individual.”

For this reason, the Agencies continue to believe that the protections of this provision must extend to consumers who hold a card for a personal, household, family or business purpose.

15 U.S.C. 1681a(c).

Section _.91(b)(2) Clear and conspicuous

The second proposed definition was for the phrase “clear and conspicuous.” Proposed § _.91 included a provision that required any written or electronic notice provided by a card issuer to the consumer pursuant to the regulations to be given in a “clear and conspicuous manner.” The proposed regulations defined “clear and conspicuous” based on the definition of this phrase found in the Agencies' privacy rules.

The Agencies received no comments on the phrase “clear and conspicuous,” and have adopted the definition as proposed in § _.91(b)(2).

Sections _.91(c) and (d) Address Validation

Proposed § _.91(c) simply restated the statutory requirements described above with some minor stylistic changes. A number of commenters noted that the requirements of this section would be difficult and expensive to implement. They stated that millions of address changes are processed every year, though very few turn out to be fraudulent.

By contrast, consumer groups suggested that the final regulations should require the card issuer to notify the consumer of a request for an address change followed by the request for an additional or replacement card, unless there are special circumstances that prevent doing so in a timely manner.

Many commenters recommended that the final rules provide credit and debit card issuers with greater flexibility to verify address changes. For example, they stated it is not clear that an address change linked with a request for an additional card is a significant indicator of identity theft. Therefore, they recommended the rules (1) specifically permit card issuers to satisfy the requirements of this section by verifying the address at the time the address change notification is received, whether or not the notification is linked to a request for an additional or replacement card; or (2) verify the address whenever a request for an additional or replacement card is made, whether or not the card issuer receives notification of an address change.

One commenter suggested that the rules should only apply to card issuers that receive direct notification of an address change rather than an address change notification from the U.S. Postal Service. The commenter asserted that there is a higher risk of fraud with a direct request for a change of address.

Consumer groups also recommended that the Agencies set a period longer than the 30-day minimum for card issuers to be on alert after an address change request. These commenters recommended that, because of billing cycles and the time it takes to issue a new card, an issuer should be required to assess the validity of an address change if it receives a request for an additional or replacement card within at least 90 days after the request for the address change.

Some commenters asked the Agencies to clarify what “other means” would be acceptable in assessing the validity of a change in address. One commenter stated that it is not cost effective to contact the customer, therefore, most card issuers would use “other means” of assessing the validity of the change of address in accordance with the policies and procedures the card issuer establishes pursuant to § _.90.

Commenters also asked the Agencies to clarify that the obligation to assess the validity of a request for an address change is not triggered unless the card issuer actually changes the cardholder's address.

Some commenters asked the Agencies to clarify whether electronic notices would be acceptable if the cardholder had previously contracted for electronic communications. Consumer groups recommended electronic notification be permitted only when the consumer consents in accordance with the E-Sign Act.

The Agencies note that the statutory provision being implemented here is quite specific. Congress mandated that the requirements set forth in section 615(e)(1)(C) of the FCRA apply to notifications of changes of address, which would necessarily include both those received directly from consumers and those received from the Postal Service. Congress also statutorily provided various methods to card issuers for assessing the validity of a change of address.

Accordingly, the final rules reflect these methods.

See

S. Rep. No. 108-166 at 14 (October 17, 2003)(accompanying S. 1753)(stating that a card issuer may rely on authentication procedures that do not involve a separate communication with the cardholder so long as the issuer has reasonably assessed the validity of the address change.)

Under § _.91(c) of the final rules, a card issuer that receives an address change notification and, within at least 30 days, a request for an additional or replacement card, may not issue an additional or replacement card

until

it has notified the cardholder or has otherwise assessed the validity of the change of address in accordance with the policies and procedures the card issuer has established pursuant to § _.90. The Agencies have concluded that card issuers should be granted additional flexibility. Therefore, § _.91(d) clarifies that a card issuer may satisfy the requirements of § _.91(c) by validating an address, according to the methods set forth in § _.91(c)(1) or (2), when it receives an address change notification, before it receives a request for an additional or replacement card. The rules do not require a card issuer that issues an additional or replacement card to validate an address whenever it receives a request for such a card, because section 114 only requires the validation of an address when the card issuer also has received a notification of a change of address.

The Agencies also revised § _.91 to clarify that a card issuer must provide to the cardholder a “reasonable” means of promptly reporting incorrect address changes whenever the card issuer notifies the cardholder of the request for an additional or replacement card.

See

S. Rep. No. 108-166 at 14 (October 17, 2003) (accompanying S. 1753) (stating that a means of reporting an incorrect change could be through the mail, by telephone, or electronically.)

The Agencies declined to adopt the recommendation that an issuer assess the validity of an address change if it receives a request for an additional or replacement card within “at least 90 days” after an address change notification, as “at least 30 days” may be a reasonable period of time in some cases. However, a card issuer that does not validate an address when it receives an address change notification may find it prudent to validate the address before issuing an additional or replacement card, even when it receives a request for such a card more than 30 days after the notification of address change. In sum, the Agencies expect card issuers to exercise diligence commensurate with their own experiences with identity theft.

The Agencies also confirm that a card issuer is not obligated to assess the validity of a notification of an address change after receiving a request for an additional or replacement card if it previously determined not to change the cardholder's address because the address change request was fraudulent.

This position is consistent with the legislative history of this section.

See

S. Rep. No. 108-166 at 14 (Oct. 17, 2003) (accompanying S. 1753) (stating that it would not be necessary for the card issuer to take these steps “if, despite receiving a request for an address change, the issuer did not actually change the cardholder's address for any reason (

e.g.

, the card issuer had previously determined that the request for an address change was invalid)”).

Section _.91(e) Form of Notice

In the preamble to the proposed rules, the Agencies noted that Congress had singled out this scenario involving card issuers and placed it in section 114 because it is perceived to be a possible indicator of identity theft. To highlight the important and urgent nature of notice that a consumer receives from a card issuer pursuant to § _.91(c), the Agencies also proposed requiring that any written or electronic notice that a card issuer provides under this paragraph must be clear and conspicuous and provided separately from its regular correspondence with the cardholder. The preamble to the proposed rules stated that a card issuer could also provide notice orally, in accordance with the policies and procedures the card issuer has established.

A few commenters recommended that this proposed requirement apply only if the issuer notifies the cardholder of the change of address request at the cardholder's former address. These commenters stated that, otherwise, the provision would prohibit other types of notices, such as those in periodic statements. Another commenter stated that this provision was not necessary because card issuers would send such notices separately in any event.

The Agencies are not convinced that such a notice would be provided separately from a card issuer's regular correspondence with the cardholder unless required. Moreover, the Agencies do not agree that this requirement should apply only if a card issuer chooses to notify the cardholder of the change of address request at the cardholder's former address in accordance with § _.91(c)(1). Even where the card issuer and cardholder agree to some other means for notice, this alternative means does not change the important nature of the notice. Therefore, § _.91(e) of the final rules provides that any written or electronic notice that the card issuer provides under this paragraph must be clear and conspicuous, and provided separately from its regular correspondence with the cardholder.

III. Section 315 of the FACT Act

A. Background

Section 315 of the FACT Act amends section 605 of the FCRA, 15 U.S.C. 1681c, by adding a new subsection (h). Section 605(h)(1) requires that, when providing a consumer report to a person that requests the report (the user), a nationwide consumer reporting agency, as defined in section 603(p) of the FCRA, (CRA) must provide a notice of the existence of a discrepancy if the address provided by the user in its request “substantially differs” from the address the CRA has in the consumer's file.

Section 605(h)(2) requires the Agencies to issue joint regulations that provide guidance regarding reasonable policies and procedures a user of a consumer report should employ when the user receives a notice of address discrepancy. These regulations must describe reasonable policies and procedures for a user of a consumer report to employ to (i) enable it to form a reasonable belief that the user knows the identity of the person for whom it has obtained a consumer report, and (ii) reconcile the address of the consumer with the CRA, if the user establishes a continuing relationship with the consumer and regularly and in the ordinary course of business furnishes information to the CRA.

B. Section-by-Section Analysis

Section _.82(a) Scope

Proposed § _.82(a) noted that the scope of section 315 differs from the scope of section 114 and explained that section 315 applies to “users of consumer reports” and “persons requesting consumer reports” (hereinafter referred to as “users”), as opposed to financial institutions and creditors. Therefore, section 315 does not apply to a financial institution or creditor that does not use consumer reports. The Agencies did not receive any comments on this section and have adopted it as proposed in the final rules.

Section _.82(b) Definition

Proposed § _.82(b) defined “notice of address discrepancy” as “a notice sent to a user of a consumer report by a CRA pursuant to 15 U.S.C. 1681c(h)(1), that informs the user of a substantial difference between the address for the consumer provided by the user in requesting the consumer report and the address or addresses the CRA has in the consumer's file.”

All other terms used in this section have the same meanings as set forth in the FCRA (15 U.S.C. 1681a).

In the preamble to the proposed rules, the Agencies noted that section 605(h)(1) requiring CRAs to provide notices of address discrepancy became effective on December 1, 2004. To the extent CRAs each have developed their own standards for delivery of notices of address discrepancy, the proposal noted that it is important for users to be able to recognize and receive notices of address discrepancy, especially if they are being delivered electronically by CRAs. For example, CRAs may provide consumer reports with some type of a code to indicate an address discrepancy. Users must be prepared to recognize the code as an indication of an address discrepancy.

While some commenters agreed with the proposed definition, a number of commenters suggested that the Agencies clarify that only a “substantial” discrepancy would trigger the requirements in this provision and that obvious errors would not. Some commenters also suggested that the Agencies provide examples of what constitutes a “substantial difference.” One commenter stated that users should be able to determine when there is a substantial difference.

As noted earlier, section 605(h)(1) requires a CRA to send a notice of address discrepancy when it determines that the address provided to the CRA by a user “substantially differs” from the address the CRA has in the consumer's file. The phrase “substantially differs” is not defined in the statute. Instead, the statute allows each CRA to construe this phrase as it chooses and, accordingly, to set the standard it will use to determine when it will send a notice of address discrepancy.

As required by section 605(h)(2), this rulemaking focuses on the obligations of users that receive a notice of address discrepancy from a CRA. The statute does not indicate that the Agencies are to define the phrase “substantially differs” for CRAs or to permit users to define that phrase themselves. Therefore, the final rules adopt the proposed definition of “notice of address discrepancy” without change.

Section _.82(c) Requirement to form a reasonable belief

Proposed § _.82(c) implemented the requirement in section 605(h)(2)(B)(i) that the Agencies prescribe regulations describing reasonable policies and procedures to enable the user to form a reasonable belief that the user knows “the identity of the person to whom the consumer report pertains” when the user receives a notice of address discrepancy. Proposed § _.82(c) stated that a user must develop and implement reasonable policies and procedures for “verifying the identity of the consumer for whom it has obtained a consumer report” whenever it receives a notice of address discrepancy. The proposal stated further that these policies and procedures must be designed to enable the user to form a reasonable belief that it knows the identity of the consumer for whom it has obtained a consumer report, or determine that it cannot do so.

A number of commenters stated that the statutory requirement that a user form a reasonable belief that it knows the identity of the consumer for whom it obtained a consumer report should only apply in situations where the user establishes a continuing relationship with the consumer.

A consumer group suggested that the language in the proposed regulation permitting a user to determine that it cannot form a reasonable belief of the identity of the consumer should be deleted because the statute specifically requires a reasonable belief to be formed. This commenter stated that the purpose of the statute was to reduce the number of new accounts opened using false addresses, and that permitting a user to satisfy its obligations under the regulations by simply determining it cannot form a reasonable belief would allow the user to open an account, effectively rendering the statute meaningless.

The purpose of section 315 is to enhance the accuracy of consumer information, specifically to ensure that the user has obtained the correct consumer report for the consumer about whom it has requested such a report. To implement this concept more clearly, § _.82(c) of the final rules provides that a user must develop and implement reasonable policies and procedures designed to enable the user to form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report when the user receives a notice of address discrepancy.

The Agencies acknowledge that an address discrepancy also may be an indicator of identity theft. To address this problem, the Agencies included address discrepancies as an example of a Red Flag in connection with the Identity Theft Red Flag regulations.

The Agencies do not agree with commenters who suggested that the proposed provision should apply only in connection with the establishment of a continuing relationship with a consumer, in other words, when a user is opening a new account. The statutory requirement in section 605(h)(2)(B)(i) that a user form a reasonable belief that it knows the identity of the consumer for whom it obtained a consumer report applies whether or not the user subsequently establishes a continuing relationship with the consumer. This is in contrast to the additional statutory requirement in section 605(h)(2)(B)(ii) that a user reconcile the address of the consumer with the CRA, only when the user establishes a continuing relationship with the consumer.

In addition, a user may receive a notice of address discrepancy with a consumer report, both in connection with the opening of an account and in other circumstances when the user already has a relationship with the consumer, such as when the consumer applies for an increased credit line. The Agencies believe it is important for a user to form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report in both of these cases. Accordingly, the final rules do not limit this provision solely to the establishment of new accounts.

Proposed § _.82(c) also provided that if a user employs the policies and procedures regarding identification and verification set forth in the CIP rules,

it would satisfy the requirement to have policies and procedures to verify the identity of the consumer. This provision took into consideration the fact that many users already may be subject to the CIP rules, and have in place procedures to comply with those rules, at least with respect to the opening of accounts. Thus, a user could rely upon its existing CIP policies and procedures to satisfy this requirement, so long as it applied them in all situations where it receives a notice of address discrepancy. The proposal also stated that any user, such as a landlord or employer, may adopt the CIP rules and apply them in all situations where it receives a notice of address discrepancy to meet this requirement, even if it is not subject to a CIP rule.

See,

e.g.

, 31 CFR 103.121(b)(2)(i) and (ii).

The Agencies requested comment on whether the CIP procedures would be sufficient to enable a user that receives a notice of address discrepancy with a consumer report to form a reasonable belief that it knows the identity of the consumer for whom it obtained the report, both in connection with the opening of an account, as well as in other circumstances where a user obtains a consumer report, such as when a user requests a consumer report to determine whether to increase the consumer's credit line, or in the case of a landlord or employer, to determine a consumer's eligibility to rent housing or for employment.

Many commenters supported the use of CIP to satisfy this requirement. Some commenters, however, asked the Agencies to clarify that once a consumer's identity was verified using CIP, it would not be necessary to re-verify that consumer's identity under this provision.

Some commenters found the proposal's preamble language confusing. These commenters did not understand why a user would need to use its CIP policies in every situation where a notice of address discrepancy was received in order to comply with this requirement; they felt that it might be possible to form a reasonable belief without using CIP in some circumstances.

Other commenters noted that the CIP rules, which were issued for different purposes, are not the appropriate standard for investigating a consumer's identity after a notice of address discrepancy because those rules permit verification of an address to occur after an account is opened and do not require contacting the consumer. One commenter stated that it was not clear whether a user relying on the CIP rules to satisfy the obligations under the regulation must comply with some or all of the requirements in the CIP rules,

including those that require policies and procedures to address circumstances when a user cannot form a reasonable belief it knows the identity of the consumer.

The Agencies believe that comparing information provided by a CRA to information the user obtains and uses (or has obtained and used) to verify a consumer's identity pursuant to the requirements set forth in the CIP rules is an appropriate way to satisfy this obligation, particularly in connection with the opening of a new account. However, when a user receives a notice of address discrepancy in connection with an existing account, after already having identified and verified the consumer in accordance with the CIP rules, the Agencies would not expect a user to employ the CIP procedures again. To address this issue and provide users with flexibility, § _.82(c) of the final rule provides examples of reasonable policies and procedures that a user may employ to enable the user to form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report. These examples include comparing information provided by the CRA with information the user: (1) Obtains and uses to verify the consumer's identity in accordance with the requirements of the CIP rules; (2) maintains in its own records, such as applications, change of address notifications, other customer account records, or retained CIP documentation; or (3) obtains from third-party sources. Another example is to verify the information in the consumer report provided by the CRA with the consumer.

If a user cannot establish a reasonable belief that the consumer report relates to the consumer about whom it has requested the report, the Agencies expect the user will not use that report. While section 605(h)(2)(B)(i) is silent on this point, other laws may be applicable in such a situation. For example, in the case of account openings, a user that is subject to the CIP rules generally will need to document how it has resolved the discrepancy between the address provided by the consumer and the address in the consumer report.

If the user cannot establish a reasonable belief that it knows the true identity of the consumer, it will need to implement the policies and procedures for addressing these circumstances as required by the CIP rules, which may involve not opening an account or closing an account.

If a user is a “financial institution” or “creditor” as defined by the FCRA, a notice of address discrepancy may be a Red Flag and require an appropriate response to prevent and mitigate identity theft under the user's Identity Theft Prevention Program.

See

e.g.

, 31 CFR 103.121(b)(3)(i)(D).

See

e.g.

, 31 CFR 103.121(b)(2)(iii).

Section _.82(d)(1) Requirement To Furnish Consumer's Address to a Consumer Reporting Agency

Proposed § _.82(d)(1) provided that a user must develop and implement reasonable policies and procedures for furnishing to the CRA from whom it received the notice of address discrepancy an address for the consumer that the user has reasonably confirmed is accurate when the following three conditions are satisfied. The first condition, in proposed § _.82(d)(1)(i), was that the user must be able to form a reasonable belief that it knows the identity of the consumer for whom the consumer report was obtained. This condition would have ensured the user would furnish a new address for the consumer to the CRA only after the user had formed a reasonable belief that it knew the identity of the consumer, using the policies and procedures set forth in paragraph § _.82(c).

The second condition, in proposed § _.82(d)(1)(ii), was that the user furnish the address to the CRA if it establishes or maintains a continuing relationship with the consumer. Section 315 specifically requires that the user furnish the consumer's address to the CRA if the user

establishes

a continuing relationship with the consumer. Therefore, proposed § _.82(d)(1)(ii) reiterated this requirement. However, because a user also may obtain a notice of address discrepancy in connection with a consumer with whom it already has an existing relationship, the proposal also provided that the user must furnish the consumer's address to the CRA from whom the user has received a notice of address discrepancy when the user maintains a continuing relationship with the consumer.

Finally, the third condition, in proposed § _.82(d)(1)(iii), provided that if the user regularly and in the ordinary course of business furnishes information to the CRA from which a notice of address discrepancy pertaining to the consumer was obtained, the consumer's address must be communicated to the CRA as part of the information the user regularly provides.

A majority of commenters recommended that the requirement to furnish a confirmed address should not apply to existing accounts. These commenters maintained that such a requirement would exceed the scope of the statute. They also noted that users often do not obtain full consumer reports for existing customers—just credit scores. These commenters noted that limited reports often do not contain an address for a customer. Some commenters also felt existing relationships should be excluded because users already would have verified a consumer's address at the time of account opening.

The Agencies have modified this section as follows. The final rules continue to provide that a user must develop and implement reasonable policies and procedures for furnishing an address for the consumer that the user has reasonably confirmed is accurate to the CRA when three conditions are present. The first condition, in § _.82(d)(1)(i), has been revised to be consistent with the earlier changes in section § _.82(c) that focus more narrowly on accuracy and require that a user form a reasonable belief that a consumer report relates to the consumer about whom it requested the report. The second condition, in § _.82(d)(1)(ii), now applies only to new accounts and states that a confirmed address must be furnished if the user “establishes” a continuing relationship with the consumer. The reference to “or maintains” a continuing relationship has been deleted. The Agencies agree with commenters that section 605(h)(2)(B)(ii) does not require the reporting of a confirmed address to a CRA in connection with existing relationships. The Agencies have concluded that users are more likely than a CRA to have an accurate address for an existing customer and, therefore, should not be required by these rules to take additional steps to confirm the accuracy of the customer's address. Users already have an ongoing duty to correct and update information for their existing customers under section 623 of the FCRA, 15 U.S.C. 1681s-2. Accordingly, under the final rules, the obligation to furnish a confirmed address for the consumer to the CRA is applicable only to new relationships. The third condition, in § _.82(d)(1)(iii), has been adopted in the final rule without substantive change.

Section _.82(d)(2) Requirement To Confirm Consumer's Address

In the preamble to the proposal, the Agencies noted that section 315 requires them to prescribe regulations describing reasonable policies and procedures for a user “to reconcile the address of the consumer” about whom it has obtained a notice of address discrepancy with the CRA “by furnishing

such

address” to the CRA. (Emphasis added.) The

Agencies noted that, even when the user is able to form a reasonable belief that it knows the identity of the consumer, there may be many reasons the initial address furnished by the consumer is incorrect. For example, a consumer may have provided the address of a secondary residence or inadvertently reversed a street number. To ensure that the address furnished to the CRA is accurate, the Agencies proposed to interpret the phrase, “such address,” as an address the user has reasonably confirmed is accurate. This interpretation would have required a user to take steps to “reconcile” the address it initially received from the consumer when it receives a notice of address discrepancy, rather than simply furnishing the initial address it received from the consumer to the CRA. Proposed § _.82(d)(2) contained the following list of illustrative measures that a user may employ to reasonably confirm the accuracy of the consumer's address:

• Verifying the address with the person to whom the consumer report pertains;

• Reviewing its own records of the address provided to request the consumer report;

• Verifying the address through third-party sources; or

• Using other reasonable means.

The Agencies solicited comment on whether these examples were necessary, or whether different or additional examples should be listed.

A number of commenters stated that requiring a user to confirm the address furnished exceeded the scope of the statute. They asserted that the benefit of improvements in the accuracy of addresses and the prevention of identity theft would not outweigh the additional burden of this requirement. A few commenters noted that complying with the CIP rules should be sufficient to verify the address. Commenters also felt that users should have the flexibility to establish their own validation processes based on risk.

As stated earlier, the Agencies believe the purpose of the statute is to enhance the accuracy of information relating to consumers by requiring the user to furnish an address that the user has reasonably confirmed is accurate.

Simply providing the CRA with the initial address supplied to the user by the consumer, and which caused the CRA to send a notice of address discrepancy, would not serve this purpose. The Agencies believe the options for confirmation listed in the regulation provide sufficient flexibility for users to confirm consumers’ addresses. For this reason, they have been adopted in the final rule as proposed, with minor technical changes. Section _.82(d)(2)(i) has been revised to conform the language with § _.82(c). Section _.82(d)(2)(ii) has been revised to emphasize the verification of the consumer's address rather than the review of the user's records to determine whether the address given by the consumer is the same.

This requirement is consistent with the legislative history which provides that this section is intended to obligate the user to utilize reasonable policies and procedures to resolve discrepancies.

See

H.R. Rep. No. 108-263 at 46 (Sept. 4, 2003) (accompanying H.R. 2622).

Section _.82(d)(3) Timing

Section 315 specifies when a user must furnish the consumer's address to the CRA. It states that this information must be furnished for the reporting period in which the user's relationship with the consumer is established. Accordingly, proposed § _.82(d)(3)(i) stated that, with respect to new relationships, the policies and procedures a user develops in accordance with § _.82(d)(1) must provide that a user will furnish the consumer's address that it has reasonably confirmed to the CRA as part of the information it regularly furnishes for the reporting period in which it establishes a relationship with the consumer.

The proposed rule also addressed other situations when a user may receive a notice of address discrepancy. Proposed § _.82(d)(3)(ii) stated that in other circumstances, such as when the user already has an existing relationship with the consumer, the user should furnish this information for the reporting period in which the user has reasonably confirmed the accuracy of the address of the consumer for whom it has obtained a consumer report.

The Agencies also noted that, in order to satisfy the requirements of both § _.82(d)(1) and § _.82(d)(3)(i), a user employing the CIP rules would have to establish a continuing relationship and verify the identity of the consumer during the same reporting period.

The Agencies recognized the timing provision for newly established relationships could be problematic for users hoping to take full advantage of the flexibility in timing for verification of identity afforded by the CIP rules. As required by statute, proposed § _.82(d)(3)(i) stated that the reconciled address must be furnished for the reporting period in which the user establishes a relationship with the consumer. Proposed § _.82(d)(1), which also mirrored the requirement of the statute, required the reconciled address to be furnished to the CRA only when the user both establishes a continuing relationship with the consumer and forms a reasonable belief that it knows the identity of the consumer to whom the consumer report relates. Typically, the CIP rules permit an account to be opened (

i.e.

, relationship to be established) if certain identifying information is provided. Verification to establish the true identity of the customer is required within a reasonable period of time

after

the account has been opened. As explained in the preamble to the proposed rules, to satisfy the requirements of both § _.82(d)(1) and § _.82(d)(3)(i), a user employing the CIP rules would have to verify the identity of the consumer using the identifying information it obtained in accordance with the CIP rules within the same reporting period that the user opens the account and establishes a continuing relationship with the consumer.

The Agencies requested comment on whether the timing for responding to notices of address discrepancy received in connection with newly established relationships and in connection with circumstances other than newly established relationships is appropriate. One commenter objected to the requirement that a user employing the CIP rules would have to both establish a continuing relationship and a reasonable belief that it knows the consumer's identity during the same reporting period. A few commenters noted that the timing for reporting should simply be “reasonable,” such as the next reporting cycle.

Because the Agencies have determined that the requirement to furnish a confirmed address will apply only to newly established accounts, the Agencies have revised § _.82(d)(3) to remove the references to the timing for furnishing reports in connection with other accounts, contained in the proposal. The final rules reflect the language in section 605(h)(2)(B)(ii), and state that a user's policies and procedures must provide that the user will furnish the consumer's address that the user has reasonably confirmed is accurate to the consumer reporting agency as part of the information it regularly furnishes for the reporting period in which it establishes a relationship with the consumer.

A timing issue still exists for a user that chooses to compare the information in the consumer report with information that the user obtains and uses to verify the consumer's identity in accordance with the CIP rules for the purpose of forming a reasonable belief that a consumer report relates to the consumer

about whom it has requested the report. However, the Agencies believe that the benefits of being able to use CIP for this purpose should outweigh any additional burden of having to establish a reasonable belief that a consumer report relates to the consumer about whom it has requested the report within the same reporting period that the user opens the account and establishes a continuing relationship with the consumer.

IV. General Provisions

The OCC, the Board, the FDIC, the OTS, and the NCUA

proposed to amend the first sentence in § _.3, which contains the definitions that are applicable throughout this part. This sentence stated that the list of definitions in § _.3 apply throughout the part “unless the context requires otherwise.” These agencies proposed to amend this introductory sentence to make clear that the definitions in § _.3 apply “for purposes of this part, unless explicitly stated otherwise.” Thus, these definitions apply throughout the part unless defined differently in an individual subpart. There were no comments on this proposal, and the change to § _.3 is adopted as proposed.

The equivalent language for the FTC already exists in 16 CFR 603.1.

OTS proposed nonsubstantive, technical changes to its rule sections on purpose and scope (§ 571.1) and disposal of consumer information (§ 571.83). OTS explained that these changes were necessary in light of the proposed incorporation of the address discrepancy section into subpart I. There were no comments on these proposed changes and they are adopted substantially as proposed. Further, since these changes render the definition of “you” in § 571.3(o) superfluous, OTS is removing that definition.

The OCC's final rules add a purpose section at § 41.1. The final rules are simply restoring the purpose section of part 41 that was inadvertently deleted when “subpart D-Medical Information” was added to this part.

V. Effective Date

The Agencies received a number of comments regarding the effective date of the final regulations and guidelines, although the proposed rulemaking did not address this issue. While consumer groups recommended that the effective date for compliance with the regulations be the minimum time allowed by law, many financial institutions and creditors requested the time for compliance be extended from between 12 to 24 months from issuance of the final rules. These commenters felt they needed time to take an inventory of their existing systems and develop new programs necessary for compliance. Some commenters noted that they likely would use technological solutions to comply with the rules and that it is necessary to schedule such projects well in advance. Commenters also noted that compliance with the final r

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.