Red Flag Rules Go into Full Effect on August 1, 2009
The rule applies only to "covered accounts" held by these entities, which, in brief, are accounts that involve a continuing financial relationship with an individual or small business to allow multiple payments for a product or service, or accounts that otherwise create a risk of identity theft. By August 1st, creditors and financial institutions are expected to have developed and implemented an identity theft prevention program that addresses the company's procedures for responding to identity thefts that are likely to arise with respect to the company's covered accounts. The program must be in writing, and must have been approved by the company's Board or senior management; and its implementation must be overseen by the Board or a designated senior employee.
The Red Flag rules also require issuers of credit cards and debit cards to assess the validity of notifications of changes of address, and provide guidance for users of consumer reports regarding the policies and procedures that should be used when consumer reporting agencies send a notice of address discrepancy.
The Federal Trade Commission extended the effective date of the rules in response to the widespread sense that many companies were unaware of the rules and unprepared for them to go into effect. At this point, however, companies are expected to be on notice of the rules, and there is no expectation of further extensions.
