SEC and CFTC Issue Final Joint Red Flag Rules and Guidelines to Protect Against Identity Theft | Practical Law

SEC and CFTC Issue Final Joint Red Flag Rules and Guidelines to Protect Against Identity Theft | Practical Law

The SEC and CFTC issued final joint red flag rules and guidelines requiring certain regulated entities to establish programs to address risks of identity theft. The rules and guidelines also implement provisions of the Dodd-Frank Act.

SEC and CFTC Issue Final Joint Red Flag Rules and Guidelines to Protect Against Identity Theft

by PLC Intellectual Property & Technology
Published on 12 Apr 2013 • USA (National/Federal)
The SEC and CFTC issued final joint red flag rules and guidelines requiring certain regulated entities to establish programs to address risks of identity theft. The rules and guidelines also implement provisions of the Dodd-Frank Act.
On April 10, 2013, the SEC and CFTC (Commissions) issued rules and guidelines to require certain regulated entities to adopt programs designed to prevent identity theft. In 2012, the Dodd-Frank Wall Street Reform and Consumer Protection Act amended the Fair Credit Reporting Act to transfer to the Commissions rulemaking responsibility and enforcement authority for identity theft red flags rules for entities subject to each agency's enforcement authority. These entities include broker-dealers, mutual funds, investment advisers and certain other regulated agencies. The final rules:
  • Require financial institutions and creditors to develop and implement written identity theft prevention programs aimed to detect, prevent and mitigate identity theft in connection with certain existing accounts or new accounts.
  • Establish special requirements for any credit and debit card issuers subject to the Commissions' respective enforcement authorities, to assess the validity of notifications of changes of address under certain circumstances.
Regulated entities subject to the rules must establish identity theft prevention programs with policies and procedures that:
  • Identify relevant red flags.
  • Detect the red flags.
  • Respond appropriately to detected red flags.
  • Periodically update the program to reflect changes in identity theft risks to customers and the regulated entity.
After receiving 27 comment letters, the Commissions adopted final rules substantially similar to their proposed rules from February 2012. For more information on the proposed rules, see Legal Update, SEC and CFTC Propose Joint Red Flag Rules and Guidelines to Protect Against Identity Theft. The final rules also do not expand the requirements of the rules adopted by the FTC (jointly with the federal bank regulatory agencies) in 2007 or the scope of those rules to include new entities that were not already previously covered.
The rules also contain examples and minor language changes to aid compliance. The Commissions therefore advise that this may cause some entities that had not previously complied with the 2007 rules to determine that they fall within the scope of the Commissions' rules.
The rules and guidelines will be effective May 20, 2013. Entities subject to regulation must be in compliance with the rules and guidelines by November 20, 2013.