Identity Theft Red Flags Rules

Federal RegisterApr 19, 2013

Ask Donna

What actually matters in this document.

Text

COMMODITY FUTURES TRADING COMMISSION

17 CFR Part 162

RIN 3038-AD14

SECURITIES AND EXCHANGE COMMISSION

17 CFR Part 248

[Release Nos. 34-69359, IA-3582, IC-30456; File No. S7-02-12]

RIN 3235-AL26

Identity Theft Red Flags Rules

AGENCY:

Commodity Futures Trading Commission and Securities and Exchange Commission.

ACTION:

Joint final rules and guidelines.

SUMMARY:

The Commodity Futures Trading Commission (“CFTC”) and the Securities and Exchange Commission (“SEC”) (together, the “Commissions”) are jointly issuing final rules and guidelines to require certain regulated entities to establish programs to address risks of identity theft. These rules and guidelines implement provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act, which amended the Fair Credit Reporting Act and directed the Commissions to adopt rules requiring entities that are subject to the Commissions' respective enforcement authorities to address identity theft. First, the rules require financial institutions and creditors to develop and implement a written identity theft prevention program designed to detect, prevent, and mitigate identity theft in connection with certain existing accounts or the opening of new accounts. The rules include guidelines to assist entities in the formulation and maintenance of programs that would satisfy the requirements of the rules. Second, the rules establish special requirements for any credit and debit card issuers that are subject to the Commissions' respective enforcement authorities, to assess the validity of notifications of changes of address under certain circumstances.

DATES:

Effective date:

May 20, 2013;

Compliance date:

November 20, 2013.

FOR FURTHER INFORMATION CONTACT:

CFTC: Sue McDonough, Counsel, at Commodity Futures Trading Commission, Office of the General Counsel, Three Lafayette Centre, 1155 21st Street NW., Washington, DC 20581, telephone number (202) 418-5132, facsimile number (202) 418-5524, email

smcdonough@cftc.gov;

SEC: with regard to investment companies and investment advisers, contact Andrea Ottomanelli Magovern, Senior Counsel, Amanda Wagner, Senior Counsel, Thoreau Bartmann, Branch Chief, or Hunter Jones, Assistant Director, Office of Regulatory Policy, Division of Investment Management, (202) 551-6792, or with regard to brokers, dealers, or transfer agents, contact Brice Prince, Special Counsel, Joseph Furey, Assistant Chief Counsel, or David Blass, Chief Counsel, Office of Chief Counsel, Division of Trading and Markets, (202) 551-5550, Securities and Exchange Commission, 100 F Street NE., Washington, DC 20549-8549.

SUPPLEMENTARY INFORMATION:

The Commissions are adopting new rules and guidelines on identity theft red flags for entities subject to their respective enforcement authorities. The CFTC is adding new subpart C (“Identity Theft Red Flags”) to part 162 of the CFTC's regulations [17 CFR part 162] and the SEC is adding new subpart C (“Regulation S-ID: Identity Theft Red Flags”) to part 248 of the SEC's regulations [17 CFR part 248], under the Fair Credit Reporting Act [15 U.S.C. 1681-1681x], the Commodity Exchange Act [7 U.S.C. 1-27f], the Securities Exchange Act of 1934 [15 U.S.C. 78a-78pp], the Investment Company Act of 1940 [15 U.S.C. 80a], and the Investment Advisers Act of 1940 [15 U.S.C. 80b].

Table of Contents

I. Background

II. Explanation of the Final Rules and Guidelines

A. Final Identity Theft Red Flags Rules

1. Which Financial Institutions and Creditors Are Required to Have a Program

2. The Objectives of the Program

3. The Elements of the Program

4. Administration of the Program

B. Final Guidelines

1. Section I of the Guidelines—Identity Theft Prevention Program

2. Section II of the Guidelines—Identifying Relevant Red Flags

3. Section III of the Guidelines—Detecting Red Flags

4. Section IV of the Guidelines—Preventing and Mitigating Identity Theft

5. Section V of the Guidelines—Updating the Identity Theft Prevention Program

6. Section VI of the Guidelines—Methods for Administering the Identity Theft Prevention Program

7. Section VII of the Guidelines—Other Applicable Legal Requirements

8. Supplement A to the Guidelines

C. Final Card Issuer Rules

III. Related Matters

A. Cost-Benefit Considerations (CFTC) and Economic Analysis (SEC)

B. Analysis of Effects on Efficiency, Competition, and Capital Formation

C. Paperwork Reduction Act

D. Regulatory Flexibility Act

IV. Statutory Authority and Text of Amendments

I. Background

The growth and expansion of information technology and electronic communication have made it increasingly easy to collect, maintain, and transfer personal information about individuals.

Advancements in technology also have led to increasing threats to the integrity and privacy of personal information.

During recent decades, the federal government has taken steps to help protect individuals, and to help individuals protect themselves, from the risks of theft, loss, and abuse of their personal information.

See, e.g.,

U.S. Government Accountability Office, Information Security: Federal Guidance Needed to Address Control Issues with Implementing Cloud Computing (May 2010),

available at http://www.gao.gov/new.items/d10513.pdf

(discussing information security implications of cloud computing); Department of Commerce, Internet Policy Task Force, Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework, at Section I (2010),

available at http://www.ntia.doc.gov/reports/2010/iptf_privacy_greenpaper_12162010.pdf

(reviewing recent technological changes that necessitate a new approach to commercial data protection).

see also

§ 162.30(b)(2) (CFTC) and § 248.201(b)(2) (SEC).

115

ICI Comment Letter.

Second, the final rules provide that financial institutions and creditors must involve the board of directors, an appropriate committee thereof, or a designated senior management employee in the oversight, development, implementation, and administration of the Program.

116

The designated senior management employee who is responsible for the oversight of a broker-dealer's, investment company's or investment adviser's Program may be the entity's chief compliance officer.

117

Third, the final rules provide that financial institutions and creditors must train staff, as necessary, to effectively implement their Programs.

118

116

See

§ 162.30(e)(2) (CFTC) and § 248.201(e)(2) (SEC). Section VI of the guidelines elaborates on this provision.

117

See, e.g.,

rule 38a-1(a)(4) under the Investment Company Act (addressing the chief compliance officer position), 17 CFR 270.38a-1(a)(4); rule 206(4)-7(c) under the Investment Advisers Act, 17 CFR 275.206(4)-7 (same).

118

See

§ 162.30(e)(3) (CFTC) and § 248.201(e)(3) (SEC).

Finally, the rules provide that financial institutions and creditors must exercise appropriate and effective oversight of service provider arrangements.

119

The Commissions believe that it is important that the rules address service provider arrangements so that financial institutions and creditors remain legally responsible for compliance with the rules, irrespective of whether such financial institutions and creditors outsource their identity theft red flags detection, prevention, and mitigation operations to a service provider.

120

The final rules do not prescribe a specific manner in which appropriate and effective oversight of service provider arrangements must occur. Instead, the requirement provides flexibility to financial institutions and creditors in maintaining their service provider arrangements, while making clear that such institutions and creditors are still required to fulfill their legal compliance obligations.

121

We received no comments on the substance of this aspect of the proposal

122

and are adopting the requirements related to the administration of Programs as proposed.

119

See

§ 162.30(e)(4) (CFTC) and § 248.201(e)(4) (SEC). § 162.30(b)(11) (CFTC) and § 248.201(b)(11) (SEC) define the term “service provider” to mean a person that provides a service directly to the financial institution or creditor.

120

For example, a financial institution or creditor that uses a service provider to open accounts on its behalf, could reserve for itself the responsibility to verify the identity of a person opening a new account, may direct the service provider to do so, or may use another service provider to verify identity. Ultimately, however, the financial institution or creditor remains responsible for ensuring that the activity is conducted in compliance with a Program that meets the requirements of the identity theft red flags rules.

121

These legal compliance obligations include, but are not limited to, the maintenance of records in connection with any service provider arrangements.

See

17 CFR 240.17a-4(b)(7) (requiring that each broker-dealer maintain a record of all written agreements entered into by the broker-dealer relating to its business as such); 17 CFR 275.204-2(a)(10) (requiring that each investment adviser maintain a record of all written agreements entered into by the investment adviser with any client or otherwise relating to the business of the investment adviser as such).

122

But see infra

note 143 and accompanying text (discussing a comment received on the costs associated with this aspect of the proposal).

B. Final Guidelines

As amended by the Dodd-Frank Act, section 615(e)(1)(A) of the FCRA provides that the Commissions must jointly “establish and maintain guidelines for use by each financial institution and each creditor regarding identity theft with respect to account holders at, or customers of, such entities, and update such guidelines as often as necessary.”

123

Accordingly, the Commissions are jointly adopting guidelines in an appendix to the final identity theft red flags rules that are intended to assist financial institutions and creditors in the formulation and maintenance of a Program that satisfies the requirements of the rules. These guidelines are substantially similar to the guidelines adopted by the Agencies.

123

15 U.S.C. 1681m(e)(1)(A).

The final rules require each financial institution or creditor that is required to implement a Program to consider the guidelines and include in its Program those guidelines that are appropriate.

124

The Program needs to contain reasonable policies and procedures to fulfill the requirements of the final rules, even if a financial institution or creditor determines that one or more guidelines are not appropriate for its circumstances. We received no comment on the guidelines, and the Commissions are adopting them as proposed.

124

See

§ 162.30(f) (CFTC) and § 248.201(f) (SEC).

1. Section I of the Guidelines—Identity Theft Prevention Program

Section I of the guidelines makes clear that a financial institution or creditor may incorporate into its Program, as appropriate, its existing policies, procedures, and other arrangements that control reasonably foreseeable risks to customers or to the safety and soundness of the financial institution or creditor from identity theft. An example of such existing policies, procedures, and other arrangements may include other policies, procedures, and arrangements that the financial institution or creditor has developed to prevent fraud or otherwise ensure compliance with applicable laws and regulations.

2. Section II of the Guidelines—Identifying Relevant Red Flags

Section II(a) of the guidelines sets out several risk factors that a financial institution or creditor must consider in identifying relevant red flags for covered accounts, as appropriate. These risk factors are: (i) The types of covered accounts a financial institution or creditor offers or maintains; (ii) the methods it provides to open or access its covered accounts; and (iii) its previous experiences with identity theft. Thus, for example, red flags relevant to one type of covered account may differ from those relevant to another type of covered account. Under the guidelines, a financial institution or creditor also should consider identifying as relevant those red flags that directly relate to its previous experiences with identity theft.

Section II(b) of the guidelines sets out examples of sources from which financial institutions and creditors should derive relevant red flags. As discussed in the Proposing Release, this section of the guidelines does not require financial institutions and creditors to incorporate relevant red flags strictly from these sources. Instead, financial institutions and creditors must consider them when developing a Program.

Section II(c) of the guidelines identifies five categories of red flags that financial institutions and creditors must consider including in their Programs, as appropriate:

• Alerts, notifications, or other warnings received from consumer reporting agencies or service providers, such as fraud detection services;

• Presentation of suspicious documents, such as documents that appear to have been altered or forged;

• Presentation of suspicious personal identifying information, such as a suspicious address change;

• Unusual use of, or other suspicious activity related to, a covered account; and

• Notice from customers, victims of identity theft, law enforcement authorities, or other persons regarding possible identity theft in connection with covered accounts held by the financial institution or creditor.

Supplement A to the guidelines includes a non-comprehensive list of examples of red flags from each of these categories.

3. Section III of the Guidelines—Detecting Red Flags

Section III of the guidelines provides examples of policies and procedures that a financial institution or creditor must consider including in its Program's policies and procedures for the purpose of detecting red flags. As discussed in the Proposing Release, entities that are currently subject to the Agencies' identity theft red flags rules,

125

the federal customer identification program (“CIP”) rules

126

or other Bank Secrecy Act rules,

127

the Federal Financial Institutions Examination Council's guidance on authentication,

128

or the Interagency Guidelines Establishing Information Security Standards

129

may already be engaged in detecting red flags. These entities may wish to integrate the policies and procedures already developed for purposes of complying with these rules and standards into their Programs. However, such policies and procedures may need to be supplemented.

130

125

See

2007 Adopting Release,

supra

note 8.

126

See, e.g.,

31 CFR 1023.220 (broker-dealers), 1024.220 (mutual funds), and 1026.220 (futures commission merchants and introducing brokers). The CIP regulations implement section 326 of the USA PATRIOT Act, codified at 31 U.S.C. 5318(l).

127

See, e.g.,

31 CFR 103.130 (anti-money laundering programs for mutual funds).

128

See

“Authentication in an Internet Banking Environment,”

available at http://www.ffiec.gov/pdf/authentication_guidance.pdf

129

See

12 CFR part 30, app. B (national banks); 12 CFR part 208, app. D-2 and part 225, app. F (state member banks and bank holding companies); 12 CFR part 364, app. B (state non-member banks); 12 CFR part 570, app. B (savings associations); 12 CFR part 748, app. A (credit unions).

130

For example, the CIP rules were written to implement section 326 (31 U.S.C. 5318(

)) of the USA PATRIOT Act (Pub. L. 107-56 (2001)), and certain types of “accounts,” “customers,” and products are exempted or treated specially in the CIP rules because they pose a lower risk of money laundering or terrorist financing. Such special treatment may not be appropriate to accomplish the broader objective of detecting, preventing, and mitigating identity theft.

4. Section IV of the Guidelines—Preventing and Mitigating Identity Theft

Section IV of the guidelines states that a Program's policies and procedures should provide for appropriate responses to the red flags that a financial institution or creditor has detected, that are commensurate with the degree of risk posed by each red flag. In determining an appropriate response, under the guidelines, a financial institution or creditor is required to consider aggravating factors that may heighten the risk of identity theft. Section IV of the guidelines also provides several examples of appropriate responses. These examples are identical to those included in the Agencies' final guidelines. Financial institutions and creditors also may consider adopting measures to prevent and mitigate identity theft that are not listed in the guidelines.

5. Section V of the Guidelines—Updating the Identity Theft Prevention Program

Section V of the guidelines includes a list of factors on which a financial institution or creditor could base the periodic updates to its Program. These factors are: (i) The experiences of the financial institution or creditor with identity theft; (ii) changes in methods of

identity theft; (iii) changes in methods to detect, prevent, and mitigate identity theft; (iv) changes in the types of accounts that the financial institution or creditor offers or maintains; and (v) changes in the business arrangements of the financial institution or creditor, including mergers, acquisitions, alliances, joint ventures, and service provider arrangements.

6. Section VI of the Guidelines—Methods for Administering the Identity Theft Prevention Program

Section VI of the guidelines provides additional guidance for financial institutions and creditors to consider in administering their Programs. These guideline provisions are substantially identical to those prescribed by the Agencies in their final guidelines.

i. Oversight of Identity Theft Prevention Program

Section VI(a) of the guidelines states that oversight by the board of directors, an appropriate committee of the board, or a designated senior management employee should include: (i) Assigning specific responsibility for the Program's implementation; (ii) reviewing reports prepared by staff regarding compliance by the financial institution or creditor with the final rules; and (iii) approving material changes to the Program as necessary to address changing identity theft risks.

ii. Reporting to the Board of Directors

Section VI(b) of the guidelines states that staff of the financial institution or creditor responsible for development, implementation, and administration of its Program should report to the board of directors, an appropriate committee of the board, or a designated senior management employee, at least annually, on compliance by the financial institution or creditor with the final rules. In addition, section VI(b) of the guidelines provides that the report should address material matters related to the Program and evaluate issues such as recommendations for material changes to the Program.

131

The other issues referenced in the guideline are: (i) The effectiveness of the policies and procedures of the financial institution or creditor in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts; (ii) service provider arrangements; and (iii) significant incidents involving identity theft and management's response.

iii. Oversight of Service Provider Arrangements

Section VI(c) of the guidelines provides that whenever a financial institution or creditor engages a service provider to perform an activity in connection with one or more covered accounts, the financial institution or creditor should take steps to ensure that the activity of the service provider is conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft. As discussed in the Proposing Release, the Commissions believe that these guidelines make clear that a service provider that provides services to multiple financial institutions and creditors may do so in accordance with its own program to prevent identity theft, as long as the service provider's program meets the requirements of the identity theft red flags rules.

Section VI(c) of the guidelines also includes, as an example of how a financial institution or creditor may comply with this provision, that a financial institution or creditor could require the service provider by contract to have policies and procedures to detect relevant red flags that may arise in the performance of the service provider's activities, and either report the red flags to the financial institution or creditor, or to take appropriate steps to prevent or mitigate identity theft. In those circumstances, the Commissions expect that the contractual arrangements would include the provision of sufficient documentation by the service provider to the financial institution or creditor to enable it to assess compliance with the identity theft red flags rules.

7. Section VII of the Guidelines—Other Applicable Legal Requirements

Section VII of the guidelines identifies other applicable legal requirements from the FCRA and USA PATRIOT Act that financial institutions and creditors should keep in mind when developing, implementing, and administering their Programs.

8. Supplement A to the Guidelines

Supplement A to the guidelines provides illustrative examples of red flags that financial institutions and creditors are required to consider incorporating into their Programs, as appropriate. These examples are substantially similar to the examples identified in the Agencies' final guidelines. The examples are organized under the five categories of red flags that are set forth in section II(c) of the guidelines.

The Commissions recognize that some of the examples of red flags may be more reliable indicators of identity theft, while others are more reliable when detected in combination with other red flags. The Commissions intend that Supplement A to the guidelines be flexible and allow a financial institution or creditor to tailor the red flags it chooses for its Program to its own operations. Although the final rules do not require a financial institution or creditor to justify to the Commissions failure to include in its Program a specific red flag from the list of examples, a financial institution or creditor has to account for the overall effectiveness of its Program, and ensure that the Program is appropriate to the entity's size and complexity, and to the nature and scope of its activities.

C. Final Card Issuer Rules

Section 615(e)(1)(C) of the FCRA provides that the CFTC and SEC must “prescribe regulations applicable to card issuers to ensure that, if a card issuer receives notification of a change of address for an existing account, and within a short period of time (during at least the first 30 days after such notification is received) receives a request for an additional or replacement card for the same account, the card issuer may not issue the additional or replacement card, unless the card issuer applies certain address validation procedures.”

132

Accordingly, the Commissions are adopting rules that set out the duties of card issuers regarding changes of address.

133

These rules are similar to the final card issuer rules adopted by the Agencies.

134

The rules apply only to a person that issues a debit or credit card (“card issuer”) and that is subject to the enforcement authority of either Commission.

135

The Commissions did not receive any comments on the card issuer rules, and are adopting them as proposed.

132

15 U.S.C. 1681m(e)(1)(C).

133

See

§ 162.32 (CFTC) and § 248.202 (SEC).

134

See, e.g.,

16 CFR 681.3 (FTC).

135

See supra

Section II.A.1.

As discussed in the Proposing Release, the CFTC is not aware of any entities subject to its enforcement authority that issue debit or credit cards and, as a matter of practice, believes that it is highly unlikely that CFTC-regulated entities would issue debit or credit cards. As also discussed in the Proposing Release, the SEC understands that a number of entities within its enforcement authority issue cards in partnership with affiliated or unaffiliated banks and financial institutions, but that these cards are generally issued by the partner bank, and not by the SEC-regulated entity. The SEC therefore expects that no entities within its enforcement authority will be subject to the card issuer rules.

III. Related Matters

A. Cost-Benefit Considerations (CFTC) and Economic Analysis (SEC)

CFTC

Section 15(a) of the CEA

136

requires the CFTC to consider the costs and benefits of its actions before promulgating a regulation under the CEA or issuing certain orders. Section 15(a) further specifies that the costs and benefits shall be evaluated in light of the following five broad areas of market and public concern: (1) Protection of market participants and the public; (2) efficiency, competitiveness, and financial integrity of futures markets; (3) price discovery; (4) sound risk management practices; and (5) other public interest considerations. The CFTC considers the costs and benefits resulting from its discretionary determinations with respect to the section 15(a) considerations.

137

In the paragraphs that follow, the CFTC summarizes the proposal and comments to the same before considering the costs and benefits of the final rule in light of the 15(a) considerations.

136

7 U.S.C. 19(a).

137

Id.

Cost-Benefit Considerations of Identity Theft Red Flags Rules

Background and Proposal.

As discussed above, section 1088 of the Dodd-Frank Act transferred authority over certain parts of FCRA from the Agencies to the CFTC and the SEC for entities they regulate. On February 28, 2012, the CFTC, together with the SEC, issued proposed rules to help protect investors from identity theft by ensuring that FCMs, IBs, CPOs, and other CFTC-regulated entities create programs to detect and respond appropriately to red flags.

138

The proposed rules, which were substantially similar to rules adopted in 2007 by the FTC and other federal financial regulatory agencies, would require CFTC-regulated entities to adopt written identity theft programs that include reasonable policies and procedures to: (1) Identify relevant red flags; (2) detect the occurrence of red flags; (3) respond appropriately to the detected red flags; and (4) periodically update their programs. The proposed rules also included guidelines and examples of red flags to help regulated entities administer their programs.

138

77 FR 13450 (Mar. 6, 2012).

In its proposed consideration of costs and benefits pursuant to CEA section 15(a), the CFTC stated that section 162.30 should not result in any significant new costs or benefits because it generally reflects a statutory transfer of enforcement authority from the FTC to the CFTC. The CFTC requested comment on all aspects of its proposed consideration of costs and benefits.

Comments.

The CFTC received two comments on its consideration of the costs and benefits of the joint proposal. These two commenters were divided on the reasonableness of the Commissions' estimated costs of compliance. In a letter focused on the SEC's proposed regulations (which are, of course, substantially similar to the CFTC's proposed regulations), one commenter stated that because Regulation S-ID “is substantially similar to” the existing FTC rules and guidelines, broker-dealers should not bear “any new costs in coming into compliance with proposed Regulation S-ID.”

139

This commenter further stated that “broker-dealers should already have in place a program that complies with the FTC rule. While firms will need to update some of their procedures to reflect the SEC's new responsibility for the oversight of the application of this rule, many of the changes would be cosmetic and grammatical in nature.”

140

In marked contrast, another comment letter, submitted on behalf of the Financial Services Roundtable (“FSR”) and the Securities Industry and Financial Markets Association (“SIFMA”), stated that the “consensus of our members is that the estimated compliance costs for the proposed Rules are extremely low and unrealistic.”

141

139

See

NSCP Comment Letter.

140

Id.

141

See

FSR/SIFMA Comment Letter.

The FSR/SIFMA Comment Letter also stated that the FSR and SIFMA members estimated that the initial compliance burden to implement the rules would average 2,000 hours for each line of business conducted by a “large, complex financial institution,” noting that the estimate would vary based on the number of “covered accounts” for each line of business. In addition, this comment letter also stated that continuing compliance monitoring for such an institution would average 400 hours annually. They did not provide any data or information from which the CFTC could replicate its estimates.

The FSR/SIFMA Comment Letter also stated that “financial institutions with an existing Red Flags program would experience an incremental burden due to reassessing the scope of the `covered accounts' and reevaluating whether a business activity would be defined as a `financial institution' or as a `creditor' for purposes of the Agencies' Rules.”

142

The letter did not attribute a time estimate to this “incremental burden.”

142

Id.

Finally, the FSR/SIFMA Comment Letter contended that the Commissions' “estimated compliance costs further fail to consider the cost to third-party service providers, many of which may be required to implement an identity theft program even though they are not financial institutions or creditors.”

143

Id.

CFTC Response to Comments Regarding Costs and Benefits.

In considering the costs and benefits of the final rules, the CFTC assumes that each CFTC-regulated entity covered by the final rules is already in existence and acting in compliance with the law, including the FTC's identity theft rules.

144

Under this assumption, the CFTC believes, as one of the commenters did,

145

that entities will incur few if any new costs in complying with the CFTC's regulations because they are largely unchanged in terms of scope and substance from the FTC's rules. The CFTC believes that the costs of compliance for such entities may actually decrease as a result of the additional guidance provided in this rulemaking. Without such guidance from the CFTC, entities might incur the costs of seeking advice from third parties. With respect to the comment that CFTC-regulated entities will experience an “incremental burden” in reassessing covered accounts and determining whether their activities fall within the scope of the rules,

146

the CFTC notes that the FTC's identity theft rules also include the requirement to periodically reassess covered accounts, and thus costs associated with this requirement are not new costs.

144

As discussed above, the final rules implement a shift in oversight of identity theft red flags rules for CFTC-regulated entities from the FTC to the CFTC. The rules do not contain new requirements, nor do they substantially expand the scope of the FTC's rules. Most entities should already be in compliance with the FTC's existing rules, which the FTC began enforcing on January 1, 2011.

145

See

NSCP Comment Letter.

146

See supra

note 142 and accompanying text.

With regard to the estimate in the FSR/SIFMA Comment Letter that a “large, complex financial institution” will incur 2,000 hours of “initial compliance burden,”

147

the CFTC is unaware of any such institution that is not already acting in compliance with the FCRA and the FTC's rules. But even if such a large, complex financial institution exists and is not already in compliance with FCRA and the FTC's rules, the “initial burden” that such an entity would incur is largely attributable to the FCRA, as amended by the Dodd-Frank Act. As discussed above,

Congress mandated that the CFTC promulgate rules to bring its regulated entities into compliance with FCRA, and the CFTC has elected to do so in a manner that imposes minimal incremental cost on CFTC-regulated entities. In response to the comments concerning the costs to “third-party service providers,” the CFTC stresses these costs have already been taken into account, as CFTC-regulated entities that have outsourced identity theft detection, prevention, and mitigation operations to affiliates or third-party service providers have effectively shifted a burden that the CFTC-regulated entities otherwise would have carried themselves.

147

See

FSR/SIFMA Comment Letter.

One commenter also stated that since it maintains no covered accounts and has no plans to, it should be specifically excluded from the scope of the rules to avoid any potential that it would be subject to the requirements of the final rules. According to this commenter, to include it within the scope of the final rules would require it needlessly to incur compliance costs associated with periodically reassessing whether they maintain any covered accounts and documenting the same.

148

See

OCC Comment Letter.

The majority of the per-entity costs associated with the final rules would be incurred by those financial institutions and creditors that maintain covered accounts.

149

Additionally, even if financial institutions and creditors do not currently maintain, or intend to maintain, covered accounts, such entities must nevertheless periodically assess whether they maintain covered accounts, as certain accounts may be deemed to be “covered accounts” if reasonably foreseeable identity theft risks are associated with these accounts.

150

Moreover, the CFTC reiterates that the final rules do not contain any new requirements or significantly expand the scope of the pre-existing FTC rules. Therefore, no financial institutions or creditors, regardless of whether they maintain covered accounts, should incur any additional costs other than the costs already being incurred under the previous regulatory framework.

149

See infra

notes 151 and 152.

150

See supra

notes 95-100 and accompanying text.

Consideration of Costs and Benefits in Light of CEA Section 15(a).

As discussed above, the Dodd-Frank Act shifted enforcement authority over CFTC-regulated entities that are subject to section 615(e) of the FCRA from the FTC to the CFTC. Section 615(e) of the FCRA, as amended by the Dodd-Frank Act, requires that the CFTC, jointly with the Agencies and the SEC, adopt identity theft red flags rules. To carry out this requirement, the CFTC is adopting section 162.30, which is substantially similar to the identity theft red flags rules adopted by the Agencies in 2007.

Section 162.30 will shift oversight of identity theft rules of CFTC-regulated entities from the FTC to the CFTC. These entities should already be in compliance with the FTC's existing identity theft red flags rules, which the FTC began enforcing on January 1, 2011. Because section 162.30 is substantially similar to those existing rules, these entities should not bear any significant costs in coming into compliance with section 162.30. The new regulation does not contain new requirements, nor does it expand the scope of the rules significantly. The new regulation does contain examples and minor language changes designed to help guide entities within the CFTC's enforcement authority in complying with the rules, which the CFTC expects will mitigate costs of compliance. Moreover, section 162.30 would not impose any significant new costs on new entities since any newly-formed entities would already be covered under the FTC's existing rules.

In the analysis for the Paperwork Reduction Act of 1995 (“PRA”) below, the staff identified certain initial and ongoing hour burdens and associated time costs related to compliance with section 162.30. However, these costs are not new costs, but are current costs associated with compliance with the Agencies' existing rules. CFTC-regulated entities will incur these hours and costs regardless of whether the CFTC adopts section 162.30. These hours and costs would be transferred from the Agencies' PRA allotment to the CFTC. No new costs should result from the adoption of section 162.30.

These existing costs related to section 162.30 would include, for newly-formed CFTC-regulated entities, the one-time cost for financial institutions and creditors to conduct initial assessments of covered accounts, create a Program, obtain board approval of the Program, and train staff.

151

The existing costs would also include the ongoing cost to periodically review and update the Program, report periodically on the Program, and conduct periodic assessments of covered accounts.

152

151

CFTC staff estimates that the one-time burden of compliance would include 2 hours to conduct initial assessments of covered accounts, 25 hours to develop and obtain board approval of a Program, and 4 hours to train staff. CFTC staff estimates that, of the 31 hours incurred, 12 hours would be spent by internal counsel at an hourly rate of $354, 17 hours would be spent by administrative assistants at an hourly rate of $66, and 2 hours would be spent by the board of directors as a whole, at an hourly rate of $4000, for a total cost of $13,370 per entity for entities that need to come into compliance with proposed subpart C to Part 162. This estimate is based on the following calculations: $354 × 12 hours = $4,248; $66 × 17 = $1,122; $4,000 × 2 = $8,000; $4,248 + $1,122 + $8,000 = $13,370.

As discussed in the PRA analysis, CFTC staff estimates that there are 702 CFTC-regulated entities that newly form each year and that would fall within the definitions of “financial institution” or “creditor.” Of these 702 entities, 54 entities would maintain covered accounts.

See infra

note 168 and text following note 168. CFTC staff estimates that 2 hours of internal counsel's time would be spent conducting an initial assessment to determine whether they have covered accounts and whether they are subject to the proposed rule (or 702 entities). The cost associated with this determination is $497,016 based on the following calculation: $354 × 2 = $708; $708 × 702 = $497,016. CFTC staff estimates that 54 entities would bear the remaining specified costs for a total cost of $683,748 (54 × $12,662 = $683,748).

See

SIFMA's Office Salaries in the Securities Industry 2011.

Staff also estimates that in response to Dodd-Frank, there will be approximately 125 newly registered SDs and MSPs. Staff believes that each of these SDs and MSPs will be a financial institution or creditor with covered accounts. The additional cost of these SDs and MSPs is $1,671,250 (125 × $13,370 = $1,671,250).

152

CFTC staff estimates that the ongoing burden of compliance would include 2 hours to conduct periodic assessments of covered accounts, 2 hours to periodically review and update the Program, and 4 hours to prepare and present an annual report to the board, for a total of 8 hours. CFTC staff estimates that, of the 8 hours incurred, 7 hours would be spent by internal counsel at an hourly rate of $354 and 1 hour would be spent by the board of directors as a whole, at an hourly rate of $4,000, for a total hourly cost of $6,500. This estimate is based on the following calculations rounded to two significant digits: $354 × 7 hours = $2,478; $4,000 × 1 hour = $4,000; $2,478 + $4,000 = $6,478 ≉ $6,500.

As discussed in the PRA analysis, CFTC staff estimates that 2,946 existing CFTC-regulated entities would be financial institutions or creditors, of which 260 maintain covered accounts. CFTC staff estimates that 2 hours of internal counsel's time would be spent conducting periodic assessments of covered accounts and that all financial institutions or creditors subject to the proposed rule (or 2,946 entities) would bear this cost for a total cost of $2,100,000 based on the following calculations rounded to two significant digits: $354 × 2 = $708; $708 × 2,946 = $2,085,768 ≉ $2,100,000. CFTC staff estimates that 260 entities would bear the remaining specified ongoing costs for a total cost of $1,500,000 (260 × $5,770 = $1,500,200 ≉ $1,500,000).

The benefits related to adoption of section 162.30, which already exist in connection with the Agencies' identity theft red flags rules, would include a reduction in the risk of identity theft for investors (consumers) and cardholders, and a reduction in the risk of losses due to fraud for financial institutions and creditors. It is not practicable for the CFTC to estimate with precision the dollar value associated with the benefits that will inure to the public from the adoption of section 162.30, as the quantity or value of identity theft

deterred or prevented is not knowable. The CFTC, however, recognizes that the cost of any given instance of identity theft may be substantial to the individual involved. Joint adoption of identity theft red flags rules in a form that is substantially similar to the Agencies' identity theft red flags rules might also benefit financial institutions and creditors because entities regulated by multiple federal agencies could comply with a single set of standards, which would reduce potential compliance costs. As is true of the Agencies' identity theft red flags rules, the CFTC has designed section 162.30 to provide financial institutions and creditors significant flexibility in developing and maintaining a Program that is tailored to the size and complexity of their business and the nature of their operations, as well as in satisfying the address verification procedures.

Accordingly, as previously discussed, section 162.30 should not result in any significant new costs or benefits, because it generally reflects a statutory transfer of enforcement authority from the FTC to the CFTC, does not include any significant new requirements, and does not include new entities that were not previously covered by the Agencies' rules.

Section 15(a) Analysis.

As stated above, the CFTC is required to consider costs and benefits of proposed CFTC action in light of (1) protection of market participants and the public; (2) efficiency, competitiveness, and financial integrity of futures markets; (3) price discovery; (4) sound risk management practices; and (5) other public interest considerations. These rules protect market participants and the public by detecting, preventing, and mitigating identity theft, an illegal act that may be costly to them in both time and money.

153

Because, however, these rules create no new requirements — rather, as explained above, the CFTC is adopting rules that reflect requirements already in place — the impact of the rules on the protection of market participants and the public will remain the same. The Commission is not aware of any effect of these rules on the efficiency, competitiveness, and financial integrity of futures markets, price discovery, sound risk management practices, or other public interest considerations. Customers of CFTC registrants will continue to benefit from these rules in the same way they have benefited from the rules as they were administered by the Agencies.

153

According to the Javelin 2011 Identity Fraud Survey Report, consumer costs (the average out‐of‐pocket dollar amount victims pay) increased in 2010.

See Javelin 2011 Identity Fraud Survey Report

(2011). The report attributed this increase to new account fraud, which showed longer periods of misuse and detection and therefore more dollar losses associated with it than any other type of fraud. Notwithstanding the increase in cost, the report stated that the number of identity theft victims has decreased in recent years.

Id.

Cost-Benefit Considerations of Card Issuer Rules

With respect to specific types of identity theft, section 615(e) of the FCRA identified the scenario involving credit and debit card issuers as being a possible indicator of identity theft. Accordingly, the card issuer rules in section 162.32 set out the duties of card issuers regarding changes of address. The card issuer rules will apply only to a person that issues a debit or credit card and that is subject to the CFTC's enforcement authority. The card issuer rules require a card issuer to comply with certain address validation procedures in the event that such issuer receives a notification of a change of address for an existing account from a cardholder, and within a short period of time (during at least the first 30 days after such notification is received) receives a request for an additional or replacement card for the same account. The card issuer may not issue the additional or replacement card unless it complies with those procedures. The procedures include: (1) Notifying the cardholder of the request in writing or electronically either at the cardholder's former address, or by any other means of communication that the card issuer and the cardholder have previously agreed to use; or (2) assessing the validity of the change of address in accordance with established policies and procedures.

Section 162.32 will shift oversight of card issuer rules of CFTC-regulated entities from the FTC to the CFTC. These entities should already be in compliance with the FTC's existing card issuer rules, which the FTC began enforcing on January 1, 2011. Because section 162.32 is substantially similar to those existing card issuer rules, these entities should not bear any new costs in coming into compliance. The new regulation does not contain new requirements, nor does it expand the scope of the rules to include new entities that were not already previously covered by the Agencies' card issuer rules.

The existing costs related to section 162.32 would include the cost for card issuers to establish policies and procedures that assess the validity of a change of address notification submitted shortly before a request for an additional card and, before issuing an additional or replacement card, either notify the cardholder at the previous address or through another previously agreed-upon form of communication, or alternatively assess the validity of the address change through existing policies and procedures. As discussed in the PRA analysis, CFTC staff does not expect that any CFTC-regulated entities would be subject to the requirements of section 162.32.

The benefits related to adoption of section 162.32, which already exist in connection with the Agencies' card issuer rules, would include a reduction in the risk of identity theft for cardholders, and a reduction in the risk of losses due to fraud for card issuers. However, it is not practicable for the CFTC to estimate with precision the dollar value associated with the benefits that will inure to the public from these card issuer rules. As is true of the Agencies' card issuer rules, the CFTC has designed section 162.32 to provide card issuers significant flexibility in developing and maintaining a Program that is tailored to the size and complexity of their business and the nature of their operations.

Accordingly, as previously discussed, the card issuer rules should not result in any significant new costs or benefits, because they generally reflect a statutory transfer of enforcement authority from the FTC to the CFTC, do not include any significant new requirements, and do not include new entities that were not previously covered by the Agencies' rules.

Section 15(a) Analysis.

As stated above, the CFTC is required to consider costs and benefits of proposed CFTC action in light of (1) Protection of market participants and the public; (2) efficiency, competitiveness, and financial integrity of futures markets; (3) price discovery; (4) sound risk management practices; and (5) other public interest considerations. These rules protect market participants and the public by preventing identity theft, an illegal act that may be costly to them in both time and money.

154

Because, however, these rules create no new requirements—rather, as explained above, the CFTC is adopting rules that reflect requirements already in place—their cost and benefits have no incremental impact on the five section 15(a) factors. Customers of CFTC registrants will continue to benefit from these rules in the same way they have benefited from the rules as they were administered by the Agencies.

154

See id.

SEC

The SEC is sensitive to the costs and benefits imposed by its rules. As discussed above, the Dodd-Frank Act shifted enforcement authority over SEC-regulated entities that are subject to section 615(e) of the FCRA from the Agencies to the SEC. Section 615(e) of the FCRA, as amended by the Dodd-Frank Act, requires that the SEC, jointly with the Agencies and the CFTC, adopt identity theft red flags rules and guidelines. To carry out this requirement, the SEC is adopting Regulation S-ID, which is substantially similar to the identity theft red flags rules and guidelines adopted by the Agencies in 2007, and whose scope covers the same categories of SEC-regulated entities that were covered under the Agencies' red flags rules.

Regulation S-ID requires a financial institution or creditor that is subject to the SEC's enforcement authority and that offers or maintains covered accounts to develop, implement, and administer a written identity theft prevention Program. A financial institution or creditor must design its Program to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. A financial institution or creditor also must appropriately tailor its Program to its size and complexity, and to the nature and scope of its activities. In addition, a financial institution or creditor must take certain steps to comply with the requirements of the identity theft red flags rules, including training staff, providing annual reports to the board of directors, an appropriate committee thereof, or a designated senior management employee, and, if applicable, oversight of service providers.

Section 615(e)(1)(C) of the FCRA singles out change of address notifications sent to credit and debit card issuers as a possible indicator of identity theft, and requires the SEC to prescribe regulations concerning such notifications. Accordingly, the card issuer rules in this release set out the duties of card issuers regarding changes of address. The card issuer rules apply only to SEC-regulated entities that issue credit or debit cards.

155

The card issuer rules require a card issuer to comply with certain address validation procedures in the event that such issuer receives a notification of a change of address for an existing account, and within a short period of time (during at least the first 30 days after it receives such notification) receives a request for an additional or replacement card for the same account. The card issuer may not issue the additional or replacement card unless it complies with those procedures. The procedures include: (1) Notifying the cardholder of the request either at the cardholder's former address, or by any other means of communication that the card issuer and the cardholder have previously agreed to use; or (2) assessing the validity of the change of address in accordance with established policies and procedures.

155

See

§ 248.202(a) (defining scope of the SEC's rules).

The baseline we use to analyze the economic effects of Regulation S-ID is the identity theft red flags regulatory scheme administered by the Agencies. Regulation S-ID, as discussed above, implements the transfer of oversight of identity theft red flags rules for SEC-regulated entities from the Agencies to the SEC. Entities that qualify as a financial institution or creditor and offer or maintain covered accounts should already have existing identity theft red flags Programs. Regulation S-ID does not contain new requirements, nor does it expand the scope of the Agencies' rules to include new entities that the Agencies' rules did not previously cover. Regulation S-ID does contain examples and minor language changes designed to help guide entities within the SEC's enforcement authority in complying with the rules. Because Regulation S-ID is substantially similar to the Agencies' rules, the entities within its scope should not bear new costs in coming into compliance with Regulation S-ID.

156

See, e.g.,

NSCP Comment Letter (“Because proposed Regulation S-ID is substantially similar to [the Agencies'] existing rules and guidelines, broker-dealer firms should not bear any new costs in coming into compliance with proposed Regulation S-ID.”). As previously indicated, the SEC staff understands that a number of investment advisers may not currently have identity theft red flags Programs.

See supra

note 55 and

infra

notes 186 and 190. The new guidance in this release may lead some of these entities to determine that they should comply with Regulation S-ID. Although the costs and benefits of Regulation S-ID discussed below would be new to these entities, the costs would result not from Regulation S-ID but instead from the entities' recognition that these rules and the previously-existing rules apply to them. In that regard, the initial, one-time costs of Regulation S-ID could be up to $756 for each investment adviser that qualifies as a financial institution or creditor, and additional one-time costs of $13,885 for each such investment adviser that maintains covered accounts.

See infra

notes 158 and 159. Not all investment advisers will bear the full extent of these costs, however, as some may already have in place certain identity theft protections. And, the guidance in this release could have the benefit of further reducing identity theft.

See infra

discussion of benefits in Part III.A of this release.

Costs

The costs of complying with section 248.201 of Regulation S-ID include both ongoing costs and initial, one-time costs.

157

These are the same costs that were associated with the requirements of the Agencies' red flags rules, and these costs will continue to apply after the adoption of the SEC's identity theft red flags rules (section 248.201 of Regulation S-ID). The ongoing costs include the costs to periodically review and update the Program, report on the Program, and conduct assessments of covered accounts.

158

All entities that qualify as financial institutions or creditors and that maintain covered accounts will bear these costs. Existing entities subject to Regulation S-ID should already bear, and will continue to be subject to, the ongoing costs.

157

See infra

note 182 and accompanying text.

158

Unless otherwise stated, all cost estimates for personnel time are derived from SIFMA's Management & Professional Earnings in the Securities Industry 2011, modified to account for an 1800-hour work-year and multiplied by 5.35 to account for bonuses, entity size, employee benefits, and overhead. The estimates in this release, both for salary rates and numbers of entities affected, have been updated from those in the Proposing Release to reflect recent SIFMA management and professional salary data.

SEC staff estimates that the ongoing burden of compliance will include 2 hours to conduct periodic assessments of covered accounts, 2 hours to periodically review and update the Program, and 4 hours to prepare and present an annual report to the board, for a total of 8 hours. SEC staff estimates that, of the 8 hours incurred, 7 hours will be spent by internal counsel at an hourly rate of $378 and 1 hour will be spent by the board of directors as a whole, at an hourly rate of $4500, for a total hourly cost of $7146 per entity. This estimate is based on the following calculations: $378 × 7 hours = $2646; $4500 × 1 hour = $4500; $2646 + $4500 = $7146. The cost estimate for the board of directors is derived from estimates made by SEC staff regarding typical board size and compensation that is based on information received from fund representatives and publicly available sources.

As discussed in the PRA analysis, SEC staff estimates that 10,339 existing SEC-regulated entities will be financial institutions or creditors under Regulation S-ID, and approximately 90%, or 9305, of these entities will maintain covered accounts.

See infra

notes 190 and 191 and accompanying text. SEC staff estimates that 2 hours of internal counsel's time will be spent conducting periodic assessments of covered accounts and that all financial institutions or creditors subject to the rule (or 10,339 entities) will bear this cost for a total cost of $7,816,284 based on the following calculations: $378 × 2 = $756; $756 × 10,339 = $7,816,284. SEC staff estimates that 9305 entities will bear the remaining specified ongoing costs for a total cost of $59,458,950 (9305 × (($378 × 5) + ($4500 × 1)) = $59,458,950).

Initial, one-time costs relate to the initial assessments of covered accounts, creation of a Program, board approval of the Program, and the training of staff.

159

New entities will bear these costs.

159

SEC staff estimates that the incremental one-time burden of compliance includes 2 hours to conduct initial assessments of covered accounts, 25 hours to develop and obtain board approval of a Program, and 4 hours to train staff. SEC staff estimates that, of the 31 hours incurred, 12 hours will be spent by internal counsel at an hourly rate of $378, 17 hours will be spent by administrative

assistants at an hourly rate of $65, and 2 hours will be spent by the board of directors as a whole, at an hourly rate of $4500, for a total cost of $14,641 per new entity. This estimate is based on the following calculations: $378 × 12 hours = $4536; $65 × 17 = $1105; $4500 × 2 = $9000; $4536 + $1105 + $9000 = $14,641. The cost estimate for administrative assistants is derived from SIFMA's Office Salaries in the Securities Industry 2011, modified to account for an 1800-hour work-year and multiplied by 2.93 to account for bonuses, entity size, employee benefits, and overhead.

As discussed in the PRA analysis, SEC staff estimates that there are 1271 SEC-regulated entities that newly form each year and that could be financial institutions or creditors, of which 668 are likely to qualify as financial institutions or creditors.

See infra

note 186. Of these 668 entities that are likely to qualify as financial institutions or creditors, SEC staff estimates that approximately 90%, or 601, of these entities will maintain covered accounts.

See infra

note 188 and accompanying text. SEC staff estimates that 2 hours of internal counsel's time will be spent conducting an initial assessment of covered accounts and that all newly-formed financial institutions or creditors subject to Regulation S-ID (or 668 entities) will bear this cost for a total cost of $505,008 based on the following calculation: $378 × 2 = $756; $756 × 668 = $505,008. SEC staff estimates that the 601 entities that will maintain covered accounts will bear the remaining specified costs for a total cost of $8,344,885 (601 × (($378 × 10) + ($65 × 17) + ($4500 × 2)) = $8,344,885).

As discussed above, the final rules require financial institutions and creditors to tailor their Programs to the size and complexity of the entity and to the nature and scope of the entity's activities. Ongoing and one-time costs will therefore depend on the size and complexity of the SEC-regulated entity. Entities may already have other policies and procedures in place that are designed to reduce the risks of identity theft for their customers. The presence of other related policies and procedures could reduce the ongoing and one-time costs of compliance.

Two commenters agreed with the SEC that the substantial similarity of Regulation S-ID to the Agencies' rules should minimize any compliance costs for entities that have previously complied with the Agencies' rules,

160

and another commenter stated that the benefits of reduced risk of identity theft would outweigh the costs associated with the rules.

161

Another commenter raised concerns with the cost estimates in the Proposing Release, and argued that actual costs of compliance could be much greater than estimated.

162

This commenter provided hour burden estimates for large, complex financial institutions that were significantly higher than the estimates made for those entities in the Proposing Release. Additionally, the commenter stated that the Commissions' estimated compliance costs did not consider the costs to third-party service providers that may be required to implement an identity theft red flags Program, even though they are not financial institutions or creditors. The commenter also noted, however, that burdens placed upon entities currently complying with the Agencies' rules would be the same burdens that each of these entities already incurs in regularly assessing whether it maintains covered accounts and evaluating whether it falls within the rules' scope.

160

See

NSCP Comment Letter (“Because proposed Regulation S-ID is substantially similar to [the Agencies'] existing rules and guidelines, broker-dealer firms should not bear any new costs in coming into compliance with proposed Regulation S-ID.”); ICI Comment Letter (“We commend the Commission for proposing requirements that are consistent with those that have applied to certain SEC registrants since 2008 pursuant to rules of the [FTC] under [the FACT Act]. This consistency will facilitate registrants' transition from compliance with the FTC's rule to the Commission's rule with little or no disruption or added expense.”)

161

See

Eric Speicher Comment Letter.

162

See

FSR/SIFMA Comment Letter. FSR/SIFMA estimated that “the initial compliance burden to implement the [proposed rules] would average 2,000 hours for each line of business conducted by a large, complex financial institution . . .” and that “the continuing compliance monitoring for a large, complex financial institution . . . would average 400 hours annually.” FSR/SIFMA also noted that “financial institutions with an existing Red Flags program would experience an incremental burden” in connection with the SEC's rules.

We note that the commenter who suggested that significantly higher hour burdens would be associated with the rules focused on large, complex financial institutions. Regulation S-ID requires each financial institution and creditor to tailor its Program to its size and complexity, and to the nature and scope of its activities. Our estimates take into account the hour burdens for small financial institutions and creditors, which we understand, based on discussions with industry representatives, to be significantly less than the estimates provided by this commenter. We also note that costs to service providers have already been taken into account, as SEC-regulated entities that have outsourced identity theft detection, prevention, and mitigation operations to service providers have effectively shifted a burden that the SEC-regulated entities otherwise would have carried themselves.

163

As mentioned above, the costs of Regulation S-ID are not new, and existing entities should already have identity theft red flags Programs and bear the ongoing costs associated with Regulation S-ID.

163

See infra

Section III.C. (describing the SEC's PRA collection of information requirements).

The existing costs related to the card issuer rules (section 248.202 of Regulation S-ID) include the cost for card issuers to establish policies and procedures that assess the validity of a change of address notification submitted shortly before a request for an additional or replacement card and, before issuing an additional or replacement card, either notify the cardholder at the previous address or through another previously agreed-upon form of communication, or alternatively assess the validity of the address change through existing policies and procedures. As discussed in the PRA analysis, SEC staff does not expect that any SEC-regulated entities will be subject to the card issuer rules.

In the PRA analysis below, the staff identifies certain ongoing and initial hour burdens and associated time costs related to compliance with Regulation S-ID. These hour burdens and costs are consistent with those associated with the requirements of the Agencies' existing rules.

Benefits

The benefits related to adoption of Regulation S-ID, which already exist in connection with the Agencies' identity theft red flags rules, include a reduction in the risk of identity theft for investors (consumers) and cardholders, and a reduction in the risk of losses due to fraud for financial institutions and creditors. The SEC is the federal agency best positioned to oversee the financial institutions and creditors subject to its enforcement authority because of its experience in overseeing these entities. Adoption of Regulation S-ID therefore may have the added benefit of increasing entities' adherence to their identity theft red flags Programs, thus further reducing the risk of identity theft for investors. As is true of the Agencies' identity theft red flags rules, the SEC has designed Regulation S-ID to provide financial institutions, creditors, and card issuers significant flexibility in developing and maintaining a Program that is tailored to the size and complexity of their business and the nature of their operations, as well as in satisfying the address verification procedures. Many of the benefits and costs discussed are difficult to quantify, in particular when discussing the potential reduction in the risk of identity theft. The SEC staff cannot quantify the benefits of the potential reduction in the risk of identity theft because of the uncertainty of its effect on customer behavior. Therefore, we discuss much of the benefits qualitatively but, where possible, the SEC staff attempted to quantify the costs.

Alternatives

In analyzing the costs and benefits that could result from the implementation of Regulation S-ID, the

SEC also considered the costs and benefits of any plausible alternatives to the final rules as set forth in this release. As discussed above, section 615(e) of the FCRA, as amended by the Dodd-Frank Act, requires that the SEC, jointly with the Agencies and the CFTC, adopt identity theft red flags rules and guidelines that are substantially similar to those adopted by the Agencies. The rules the SEC promulgates should achieve a similar outcome with respect to the reduction in the risk of identity theft as the rules of other Agencies. Alternatives to the identity theft red flags rules that would achieve a similar outcome may impose additional costs, especially for those entities that would need to alter existing Programs to conform to a new set of rules. The SEC does provide additional guidance in this release to better enable entities to determine whether they fall within the rules' scope. Although the SEC could have provided different guidance with this release, the SEC believes that the release provides sufficient guidance to enable entities to determine whether they need to adopt identity theft red flags Programs. Lastly, for the reasons discussed above, the SEC is not exempting certain entities from certain requirements of the identity theft red flags rules. The SEC believes that if an entity determines that it is a financial institution or a creditor that offers or maintains covered accounts, then the risk of identity theft that the rules are designed to address is present. Under such circumstances, we believe that the benefits of the rules justify the costs to the financial institution or creditor subject to the rules and, therefore, no exemptions are appropriate.

B. Analysis of Effects on Efficiency, Competition, and Capital Formation

Section 3(f) of the Exchange Act and section 2(c) of the Investment Company Act require the SEC, whenever it engages in rulemaking and must consider or determine if an action is necessary, appropriate, or consistent with the public interest, to consider, in addition to the protection of investors, whether the action would promote efficiency, competition, and capital formation. In addition, section 23(a)(2) of the Exchange Act requires the SEC, when making rules under the Exchange Act, to consider the impact the rules may have upon competition. Section 23(a)(2) of the Exchange Act prohibits the SEC from adopting any rule that would impose a burden on competition that is not necessary or appropriate in furtherance of the purposes of the Exchange Act.

164

See infra

Section IV (setting forth statutory authority under, among other things, the Exchange Act and Investment Company Act for rulemakings).

As discussed in the cost-benefit analysis above, Regulation S-ID will carry out the requirement in the Dodd-Frank Act that the SEC adopt rules governing identity theft protections, pursuant to section 615(e) of the FCRA with regard to entities that are subject to the SEC's enforcement authority. This requirement was designed to transfer regulatory oversight of identity theft red flags rules for SEC-regulated entities from the Agencies to the SEC. Regulation S-ID is substantially similar to the identity theft red flags rules adopted by the Agencies in 2007, and does not contain new requirements. The entities covered by Regulation S-ID should already be in compliance with existing identity theft red flags rules.

For the reasons discussed above, Regulation S-ID should have a negligible effect on efficiency, competition, and capital formation because it does not include new requirements and does not include new entities that were not previously covered by the Agencies' rules.

165

The SEC thereby finds that, pursuant to Exchange Act section 23(a)(2), the adoption of Regulation S-ID would not result in any burden on competition, efficiency, or capital formation that is not necessary or appropriate in furtherance of the purposes of the Exchange Act.

165

See infra

note 182 (discussing the entities that the SEC staff expects, based on discussions with industry representatives and a review of applicable law, will fall within the scope of Regulation S-ID). The SEC staff understands, however, that a number of investment advisers may not currently have identity theft red flags Programs.

See supra

note 55. The guidance in this release regarding situations in which certain SEC-regulated entities could qualify as financial institutions or creditors should not produce any significant effects. These entities may experience a negligible increase to business efficiency due to the industry-specific guidance in this release regarding the types of activities that could cause an entity to fall within the scope of Regulation S-ID. The guidance should also have a negligible effect on capital formation. Prior to Regulation S-ID, investors preferring to base their capital allocations on the existence of identity theft red flags Programs could have allocated capital with entities adhering to the Agencies' rules. The guidance therefore should have a negligible effect on the amount of capital allocated for investment purposes. In addition, all entities that conclude based on this guidance that they are subject to the final rules will be subject to the same requirements, and experience the same costs and benefits, as all other entities currently adhering to the Agencies' existing rules. The guidance therefore should have a negligible effect on competition.

C. Paperwork Reduction Act

CFTC

Provisions of sections 162.30 and 162.32 contain collection of information requirements within the meaning of the PRA. The CFTC submitted the proposal to the Office of Management and Budget (“OMB”) for review and public comment, in accordance with 44 U.S.C. 3507(d) and 5 CFR 1320.11. The title for this collection of information is “Part 162 Subpart C—Identity Theft.” Responses to this new collection of information are mandatory.

1. Information Provided by Reporting Entities/Persons

Under part 162, subpart C, CFTC regulated entities—which presently would include approximately 260 CFTC registrants

166

plus 125 new CFTC registrants pursuant to Title VII of the Dodd-Frank Act

167

—are required to design, develop and implement reasonable policies and procedures to identify relevant red flags, and potentially to notify cardholders of identity theft risks. In addition, CFTC-regulated entities are required to: (i) Collect information and keep records for the purpose of ensuring that their Programs met requirements to detect, prevent, and mitigate identity theft in

connection with the opening of a covered account or any existing covered account; (ii) develop and implement reasonable policies and procedures to identify, detect and respond to relevant red flags, as well as periodic reports related to the Program; and (iii) from time to time, notify cardholders of possible identity theft with respect to their covered accounts, as well as assess the validity of those accounts.

166

See

the NFA's Internet Web site at

http://www.nfa.futures.org/NFA-registration/NFA-membership-and-dues.HTML

for the most up-to-date number of CFTC regulated entities. For the purposes of the PRA calculation, CFTC staff used the number of registered FCMs, CTAs, CPOs IBs and RFEDs on the NFA's Internet Web site as of November 20, 2012. The NFA's site states that there are 3,485 CFTC registrants as of October 31, 2012. (The total number of registrants also includes 7 exchanges which are not subject to this rule and not included in the calculation.) Of the 3,485 registrants, there are 104 FCMs, 1,284 IBs, 1,041 CTAs, 1,035 CPOs, and 14 RFEDs. CFTC staff has observed that approximately 50 percent of all CPOs (518) are dually registered as CTAs. Moreover, CFTC staff also has observed that all entities registering as RFEDs (14) also register as FCMs. Based on these observations, the CFTC has determined that the total number of entities is 2,946 (this total excludes the 7 exchanges that are not subject to this rule, the 518 CPOs that are also registered as CTAs, and the 14 RFEDs that are also registered as FCMs).

Of the total 2,946 entities, all of the FCMs (104) are likely to qualify as financial institutions or creditors carrying covered accounts, approximately 10 percent of CTAs (104) and CPOs (52) are likely to qualify as financial institutions or creditors carrying covered accounts and none of the IBs are likely to qualify as a financial institution or creditor carrying covered accounts, for a total of 260 financial institutions or creditors that would bear the initial one-time burden of compliance with the CFTC's rules.

167

CFTC staff estimates that 125 SDs and MSPs will register with the CFTC upon the issuance of final rules under the Dodd-Frank Act further defining the terms “swap dealers” and “major swap participants” and setting forth a registration regime for these entities. The CFTC estimates the number of MSPs to be quite small, at six or fewer.

These burden estimates assume that CFTC-regulated entities already comply with the identity theft red flags rules jointly adopted by the FTC with the Agencies, as of January 1, 2011. Consequently, these entities may already have in place many of the customary protections addressing identity theft and changes of address required by these regulations.

Burden means the total time, effort, or financial resources expended by persons to generate, maintain, retain, disclose or provide information to or for a federal agency. Because compliance with identity theft red flags rules jointly adopted by the FTC with the Agencies may have occurred, the CFTC estimates the time and cost burdens of complying with part 162 to be both one-time and ongoing burdens. However, any initial or one-time burdens associated with compliance with part 162 would apply only to newly-formed entities, and the ongoing burden to all CFTC-regulated entities.

i. Initial Burden

The CFTC estimates that the one-time burden of compliance with part 162 for its regulated entities with covered accounts would be: (i) 25 hours to develop and obtain board approval of a Program; (ii) 4 hours for staff training; and (iii) 2 hours to conduct an initial assessment of covered accounts, totaling 31 hours. Of the 31 hours, the CFTC estimates that 15 hours would involve internal counsel, 14 hours expended by administrative assistants, and 2 hours by the board of directors in total, for those newly-regulated entities.

The CFTC estimates that approximately 702 FCMs, CTAs and CPOs

168

would need to conduct an initial assessment of covered accounts. As noted above, the CFTC estimates that approximately 125 newly registered SDs and MSPs would need to conduct an initial assessment of covered accounts. The total number of newly registered CFTC registrants would be 827 entities. Each of these 827 entities would need to conduct an initial assessment of covered accounts, for a total of 1,654 hours.

169

Of these 827 entities, CFTC staff estimates that approximately 179 of these entities may maintain covered accounts. Accordingly, the CFTC estimates the one-time burden for these 179 entities to be 5,191 hours,

170

for a total burden among newly registered entities of 6,845 hours.

171

168

Based on a review of new registrations typically filed with the CFTC each year, CFTC staff estimates that approximately 7 FCMs, 225 IBs, 400 CTAs, and 140 CPOs are newly formed each year, for a total of 772 entities. CFTC staff also has observed that approximately 50 percent of all CPOs are duly registered as CTAs. With respect to RFEDs, CFTC staff has observed that all entities registering as RFEDs also register as FCMs. Based on these observations, CFTC has determined that the total number of newly-formed financial institutions and creditors is 702 (772−70 CPOs that are also registered as CTAs). Each of these 702 financial institutions or creditors would bear the initial one-time burden of compliance with the proposed rules.

Of the total 702 newly-formed entities, staff estimates that all of the FCMs are likely to carry covered accounts, 10 percent of CTAs and CPOs are likely to carry covered accounts, and none of the IBs are likely to carry covered accounts, for a total of 54 newly-formed financial institutions or creditors carrying covered accounts that would be required to conduct an initial one-time burden of compliance with subpart C or Part 162.

169

This estimate is based on the following calculation: 827 entities × 2 hours = 1,654 hours.

170

This estimate is based on the following calculation: 179 entities × 29 hours = 5,191 hours.

171

This estimate is based on the following calculation: 1,654 hours for all newly registered CFTC registrants + 5,191 hours for the one-time burden of newly registered entities with covered accounts, for a total of 6,845 hours.

ii. Ongoing Burden

The CFTC staff estimates that the ongoing compliance burden associated with part 162 would include: (i) 2 hours to periodically review and update the Program, review and preserve contracts with service providers, and review and preserve any documentation received from such providers; (ii) 4 hours to prepare and present an annual report to the board; and (iii) 2 hours to conduct periodic assessments to determine if the entity offers or maintains covered accounts, for a total of 8 hours. The CFTC staff estimates that of the 8 hours expended, 7 hours would be spent by internal counsel, and 1 hour would be spent by the board of directors as a whole.

The CFTC estimates that approximately 3,071 entities may maintain covered accounts, and that they would be required to periodically review their accounts to determine if they comply with these rules, for a total of 6,142 hours for these entities.

172

Of these 3,071 entities, the CFTC estimates that approximately 385 maintain covered accounts, and thus would need to incur the additional burdens related to complying with the rule, for a total of 2,310 hours.

173

The total ongoing burden for all CFTC registrants is 8,452 hours.

174

172

This estimate is based on the following calculation: 3,071 entities x 2 hours = 6,142 hours. (The Proposing Release contained an arithmetic error in the calculation for the total ongoing burden for all CFTC registrants. The total number of hours was erroneously calculated to total 76,498 hours rather than 6,498.

See

77 FR 13450, 13467.)

173

This estimate is based on the following calculation: 385 entities x 6 hours = 2,310 hours.

174

This estimate is based on the following calculation: 6,142 hours + 2,310 hours = 8,452 hours.

SEC:

Provisions of sections 248.201 and 248.202 contain “collection of information” requirements within the meaning of the PRA. In the Proposing Release, the SEC solicited comment on the collection of information requirements. The SEC also submitted the proposed collections of information to the OMB for review in accordance with 44 U.S.C. 3507(d) and 5 CFR 1320.11. The title for this collection of information is “Part 248, Subpart C—Regulation S-ID.” In response to this submission, the OMB issued control number 3235-0692.

175

Responses to the new collection of information provisions are mandatory, and the information, when provided to the SEC in connection with staff examinations or investigations, is kept confidential to the extent permitted by law.

175

An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number.

1. Description of the Collections

Under Regulation S-ID, SEC-regulated entities are required to develop and implement reasonable policies and procedures to identify, detect and respond to relevant red flags and, in the case of entities that issue credit or debit cards, to assess the validity of, and communicate with cardholders regarding, address changes. Section 248.201 of Regulation S-ID includes the following “collections of information” by SEC-regulated entities that are financial institutions or creditors if the entity maintains covered accounts: (1) Creation and periodic updating of a Program that is approved by the board of directors, an appropriate committee thereof, or a designated senior management employee; (2) periodic staff reporting on compliance with the identify theft red flags rules and guidelines, as required to be considered by section VI of the guidelines; and (3) training of staff to implement the Program. Section 248.202 of Regulation S-ID includes the following “collections of information” by SEC-regulated entities that are credit or debit card issuers: (1) Establishment of policies and procedures that assess the validity

of a change of address notification if a request for an additional or replacement card on the account follows soon after the address change; and (2) notification of a cardholder, before issuance of an additional or replacement card, at the previous address or through some other previously agreed-upon form of communication, or alternatively, assessment of the validity of the address change request through the entity's established policies and procedures.

SEC-regulated entities that must comply with the collections of information required by Regulation S-ID should already be in compliance with the identity theft red flags rules that the Agencies jointly adopted in 2007.

176

The requirements of those rules are substantially similar and comparable to the requirements of Regulation S-ID.

177

176

SEC staff, however, understands that a number of investment advisers may not currently have identity theft red flags Programs.

See supra

note 55. Under the new guidance, for entities having now determined that they should comply with Regulation S-ID, the collections of information required by Regulation S-ID and the estimates of time and costs discussed below may be new. As discussed further below, SEC staff estimates that there are approximately 3791 investment advisers that are currently registered with the SEC and are likely to qualify as financial institutions or creditors. SEC staff is unable to estimate how many of these investment advisers previously complied with the Agencies' identity theft red flags rules.

177

See

2007 Adopting Release,

supra

note 8, at Section VI.A (discussing the PRA analysis with respect to the Agencies' identity theft red flags rules); “FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule” at

http://www.ftc.gov/opa/2010/05/redflags.shtm.

In addition, SEC staff understands that most SEC-regulated entities that are financial institutions or creditors may otherwise have in place many of the protections regarding identity theft and changes of address that Regulation S-ID requires because they are usual and customary business practices that they engage in to minimize losses from fraud. Furthermore, SEC staff believes that many of them are likely to have already effectively implemented most of the requirements as a result of having to comply (or an affiliate having to comply) with other, existing statutes, regulations and guidance, such as the federal CIP rules implementing section 326 of the USA PATRIOT Act,

178

the Interagency Guidelines Establishing Information Security Standards that implement section 501(b) of the Gramm-Leach-Bliley Act (GLBA),

179

section 216 of the FACT Act,

180

and guidance issued by the Agencies or the Federal Financial Institutions Examination Council regarding information security, authentication, identity theft, and response programs.

181

178

31 U.S.C. 5318(l) (requiring verification of the identity of persons opening accounts).

179

15 U.S.C. 6801.

180

15 U.S.C. 1681w.

181

See

2007 Adopting Release,

supra

note 8, at nn.55-57 (describing applicable statutes, regulations, and guidance).

SEC staff estimates of time and cost burdens represent the one-time burden of complying with Regulation S-ID for newly-formed SEC-regulated entities, and the ongoing costs of compliance for all SEC-regulated entities.

182

SEC staff estimates also attribute all burdens to entities that are directly subject to the requirements of the rulemaking. An entity directly subject to Regulation S-ID that outsources activities to a service provider is, in effect, shifting to that service provider the burden that it would otherwise have carried itself. Under these circumstances, the burden is, by contract, shifted from the entity that is directly subject to Regulation S-ID to the service provider, but the total amount of burden is not increased. Thus, service provider burdens are already included in the burden estimates provided for entities that are directly subject to Regulation S-ID. The time and cost estimates made here are based on conversations with industry representatives and on a review of comments received on the proposed rules as well as the estimates made in the regulatory analyses of the identity theft red flags rules previously issued by the Agencies.

182

Based on discussions with industry representatives and a review of applicable law, SEC staff expects that, of the SEC-regulated entities that fall within the scope of Regulation S-ID, most broker-dealers, many investment companies (including almost all open-end investment companies and ESCs), and some registered investment advisers will likely qualify as financial institutions or creditors. SEC staff expects that other SEC-regulated entities described in the scope section of Regulation S-ID, such as BDCs, transfer agents, NRSROs, SROs, and clearing agencies may be less likely to be financial institutions or creditors as defined in the rules, and therefore we do not include these entities in our estimates.

2. Section 248.201 (Duties Regarding the Detection, Prevention, and Mitigation of Identity Theft)

The collections of information required by section 248.201 apply to SEC-regulated enti

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.