FTC Enforcement Policy: Identity Theft Red Flags Rule, 16 CFR 681.2 

On November 9, 2007, the Federal Trade Commission (“FTC”), the federal bank 

1 regulatory agencies, and the National Credit Union Administration, published a joint notice of

final rulemaking in the Federal Register (72 FR 63718) finalizing the Identity Theft Red Flags 

regulations and guidelines. This rule, promulgated pursuant to the Fair and Accurate Credit 

Transactions Act of 2003 (“FACTA”), requires financial institutions and creditors to develop 

and implement written “identity theft prevention programs.” The programs must provide for the 

identification, detection, and response to patterns, practices, or specific activities – known as 

“red flags” – that could indicate identity theft. Although the final rule became effective on 

January 1, 2008, full compliance with the rule is not required until November 1, 2008. 

During the course of the Commission’s education and outreach efforts following 

publication of the rule, the Commission has learned that some industries and entities within the 

FTC’s jurisdiction have expressed confusion and uncertainty about their coverage under the rule. 

These entities indicated that they were not aware that they were undertaking activities that would 

cause them to fall within FACTA’s definitions of “creditor” or “financial institution.”2 Many 

entities also noted that because they generally are not required to comply with FTC rules in other 

contexts, they had not followed or even been aware of the rulemaking, and therefore learned of 

the requirements of the rule too late to be able to come into compliance by November 1, 2008. 

Given the confusion and uncertainty within major industries under the FTC’s jurisdiction 

about the applicability of the rule, and the fact that there is no longer sufficient time for members 

of those industries to develop their programs and meet the November 1 compliance date, the 

Commission believes that immediate enforcement of the rule on November 1 would be neither 

equitable for the covered entities nor beneficial to the public. Delaying Commission 

enforcement of the rule as to the entities under its jurisdiction by six months, until May 1, 2009, 

will allow these entities to take the appropriate care and consideration in developing and 

implementing their programs. It also will give the Commission time to conduct additional 

education and outreach regarding the rule. Therefore, the Commission has determined that it 

will forbear from bringing any enforcement action for violation of the Identity Theft Red Flags 

1 The Federal Deposit Insurance Corporation, the Federal Reserve Board, the Office of 

the Comptroller of the Currency, and the Office of Thrift Supervision. 

2 

Under FACTA, “creditor” is defined the same way as in the Equal Credit Opportunity 

Act (“ECOA”), as any entity that regularly extends, renews, or continues credit; any entity that 

regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an 

original creditor who is involved in the decision to extend, renew, or continue credit. The ECOA 

definition of “credit” includes a right granted to defer payment for any purchase. Thus, any 

person that provides a product or service for which the consumer pays after delivery is a creditor. 

A “financial institution” is defined by FACTA to include all banks, savings and loan 

associations, credit unions, and any other person that holds a consumer transaction account as 

defined by section 19(b) of the Federal Reserve Act. 
Rule, 16 CFR 681.2, against a financial institution or creditor that is subject to administrative 

enforcement of the Fair Credit Reporting Act by the FTC, for a period of six months following 

the mandatory compliance date of November 1, 2008. 

This delay in enforcement is limited to the Identity Theft Red Flags Rule (16 CFR 

681.2), and does not extend to the rule regarding address discrepancies applicable to users of 

consumer reports (16 CFR 681.1), or to the rule regarding changes of address applicable to card 

issuers (16 CFR 681.3). 

For questions regarding this enforcement policy, please contact Naomi Lefkovitz or 

Pavneet Singh, Bureau of Consumer Protection, 202-326-2252. 

2