Source: https://www.ecfr.gov/cgi-bin/text-idx?mc=true&node=pt12.7.717&rgn=div5
Timestamp: 2020-08-12 00:19:32
Document Index: 526764683

Matched Legal Cases: ['art 717', '§717', '§717', '§717', '§717', '§717', 'art 717', 'art 717', '§717', '§717', '§717', '§717', '§717', '§717', '§717', 'art.\n4']

Title 12 → Chapter VII → Subchapter A → Part 717
Subpart I—Duties of Users of Consumer Reports Regarding Address Discrepancies and Records Disposal
§§717.80-717.81 [Reserved]
§717.82 Duties of users regarding address discrepancies.
§717.83 Disposal of consumer information.
§717.90 Duties regarding the detection, prevention, and mitigation of identity theft.
§717.91 Duties of card issuers regarding changes of address.
Appendixes A-D to Part 717 [Reserved]
Appendixes F-I to Part 717 [Reserved]
Authority: 12 U.S.C. 1766(a), 1789; 15 U.S.C. 1681m(e).
(a) Scope. This section applies to a user of consumer reports (user) that receives a notice of address discrepancy from a consumer reporting agency described in 15 U.S.C. 1681a(p), and that is federal credit union.
(c) Reasonable belief—(1) Requirement to form a reasonable belief. A user must develop and implement reasonable policies and procedures designed to enable the user to form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report, when the user receives a notice of address discrepancy.
(B) Maintains in its own records, such as applications, change of address notifications, other member account records, or retained CIP documentation; or
(d) Consumer's address—(1) Requirement to furnish consumer's address to a consumer reporting agency. A user must develop and implement reasonable policies and procedures for furnishing an address for the consumer that the user has reasonably confirmed is accurate to the consumer reporting agency described in 15 U.S.C. 1681a(p) from whom it received the notice of address discrepancy when the user:
[72 FR 63768, Nov. 9, 2007, as amended at 74 FR 22644, May 14, 2009; 76 FR 18365, Apr. 4, 2011]
(1) Burning, pulverizing, or shredding papers containing consumer information so that the information cannot practicably be read or reconstructed.
Source: 72 FR 63768, Nov. 9, 2007, unless otherwise noted.
(a) Scope. This section applies to a financial institution or creditor that is a federal credit union.
(1) Account means a continuing relationship established by a person with a federal credit union to obtain a product or service for personal, family, household or business purposes. Account includes:
(ii) A share or deposit account.
(2) The term board of directors refers to a federal credit union's board of directors.
(i) An account that a federal credit union offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, such as a credit card account, mortgage loan, automobile loan, checking account, or share account; and
(ii) Any other account that the federal credit union offers or maintains for which there is a reasonably foreseeable risk to members or to the safety and soundness of the federal credit union from identity theft, including financial, operational, compliance, reputation, or litigation risks.
(5) Creditor has the same meaning as in 15 U.S.C. 1681a(r)(5).
(6) Customer means a member that has a covered account with a federal credit union.
(10) Service provider means a person that provides a service directly to the federal credit union.
(c) Periodic Identification of Covered Accounts. Each federal credit union must periodically determine whether it offers or maintains covered accounts. As a part of this determination, a federal credit union must conduct a risk assessment to determine whether it offers or maintains covered accounts described in paragraph (b)(3)(ii) of this section, taking into consideration:
(d) Establishment of an Identity Theft Prevention Program—(1) Program requirement. Each federal credit union that offers or maintains one or more covered accounts must develop and implement a written Identity Theft Prevention Program (Program) that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. The Program must be appropriate to the size and complexity of the federal credit union and the nature and scope of its activities.
(i) Identify relevant Red Flags for the covered accounts that the federal credit union offers or maintains, and incorporate those Red Flags into its Program;
(ii) Detect Red Flags that have been incorporated into the Program of the federal credit union;
(iv) Ensure the Program (including the Red Flags determined to be relevant) is updated periodically, to reflect changes in risks to members and to the safety and soundness of the federal credit union from identity theft.
(e) Administration of the Program. Each federal credit union that is required to implement a Program must provide for the continued administration of the Program and must:
(f) Guidelines. Each federal credit union that is required to implement a Program must consider the guidelines in appendix J of this part and include in its Program those guidelines that are appropriate.
(a) Scope. This section applies to an issuer of a debit or credit card (card issuer) that is a federal credit union.
(1) Cardholder means a member who has been issued a credit or debit card.
(c) Address validation requirements. A card issuer must establish and implement reasonable policies and procedures to assess the validity of a change of address if it receives notification of a change of address for a member's debit or credit card account and, within a short period of time afterwards (during at least the first 30 days after it receives such notification), the card issuer receives a request for an additional or replacement card for the same account. Under these circumstances, the card issuer may not issue an additional or replacement card, until, in accordance with its reasonable policies and procedures and for the purpose of assessing the validity of the change of address, the card issuer:
(2) Otherwise assesses the validity of the change of address in accordance with the policies and procedures the card issuer has established pursuant to §717.90 of this part.
The NCUA encourages voluntary furnishing of information to consumer reporting agencies. Section 717.42 of this part requires each furnisher to establish and implement reasonable written policies and procedures concerning the accuracy and integrity of the information it furnishes to consumer reporting agencies. Under §717.42(b), a furnisher must consider the guidelines set forth below in developing its policies and procedures. In establishing these policies and procedures, a furnisher may include any of its existing policies and procedures that are relevant and appropriate. Section 717.42(c) requires each furnisher to review its policies and procedures periodically and update them as necessary to ensure their continued effectiveness.
Section 717.90 of this part requires each federal credit union that offers or maintains one or more covered accounts, as defined in §717.90(b)(3) of this part, to develop and provide for the continued administration of a written Program to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. These guidelines are intended to assist federal credit unions in the formulation and maintenance of a Program that satisfies the requirements of §717.90 of this part.
In designing its Program, a federal credit union may incorporate, as appropriate, its existing policies, procedures, and other arrangements that control reasonably foreseeable risks to members or to the safety and soundness of the federal credit union from identity theft.
(a) Risk Factors. A federal credit union should consider the following factors in identifying relevant Red Flags for covered accounts, as appropriate:
(b) Sources of Red Flags. Federal credit unions should incorporate relevant Red Flags from sources such as:
(1) Incidents of identity theft that the federal credit union has experienced;
(2) Methods of identity theft that the federal credit union has identified that reflect changes in identity theft risks; and
(5) Notice from members, victims of identity theft, law enforcement authorities, or other persons regarding possible identity theft in connection with covered accounts held by the federal credit union.
(b) Authenticating members, monitoring transactions, and verifying the validity of change of address requests, in the case of existing covered accounts.
The Program's policies and procedures should provide for appropriate responses to the Red Flags the federal credit union has detected that are commensurate with the degree of risk posed. In determining an appropriate response, a federal credit union should consider aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a member's account records held by the federal credit union or a third party, or notice that a member has provided information related to a covered account held by the federal credit union to someone fraudulently claiming to represent the federal credit union or to a fraudulent website. Appropriate responses may include the following:
(b) Contacting the member;
Federal credit unions should update the Program (including the Red Flags determined to be relevant) periodically, to reflect changes in risks to members or to the safety and soundness of the federal credit union from identity theft, based on factors such as:
(a) The experiences of the federal credit union with identity theft;
(d) Changes in the types of accounts that the federal credit union offers or maintains; and
(e) Changes in the business arrangements of the federal credit union, including mergers, acquisitions, alliances, joint ventures, and service provider arrangements.
(2) Reviewing reports prepared by staff regarding compliance by the federal credit union with §717.90 of this part; and
(b) Reports. (1) In general. Staff of the federal credit union responsible for development, implementation, and administration of its Program should report to the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management, at least annually, on compliance by the federal credit union with §717.90 of this part.
(2) Contents of report. The report should address material matters related to the Program and evaluate issues such as: the effectiveness of the policies and procedures of the federal credit union in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts; service provider arrangements; significant incidents involving identity theft and management's response; and recommendations for material changes to the Program.
(c) Oversight of service provider arrangements. Whenever a federal credit union engages a service provider to perform an activity in connection with one or more covered accounts the federal credit union should take steps to ensure that the activity of the service provider is conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft. For example, a federal credit union could require the service provider by contract to have policies and procedures to detect relevant Red Flags that may arise in the performance of the service provider's activities, and either report the Red Flags to the federal credit union, or to take appropriate steps to prevent or mitigate identity theft.
Federal credit unions should be mindful of other related legal requirements that may be applicable, such as:
(a) Filing a Suspicious Activity Report under 31 U.S.C. 5318(g) and 12 CFR 748.1(c);
(b) Implementing any requirements under 15 U.S.C. 1681c-1(h) regarding the circumstances under which credit may be extended when the federal credit union detects a fraud or active duty alert;
In addition to incorporating Red Flags from the sources recommended in section II.b. of the Guidelines in appendix J of this part, each federal credit union may consider incorporating into its Program, whether singly or in combination, Red Flags from the following illustrative examples in connection with covered accounts:
3. A consumer reporting agency provides a notice of address discrepancy, as defined in §717.82(b) of this part.
4. A consumer report indicates a pattern of activity that is inconsistent with the history and usual pattern of activity of an applicant or member, such as:
6. The photograph or physical description on the identification is not consistent with the appearance of the applicant or member presenting the identification.
7. Other information on the identification is not consistent with information provided by the person opening a new covered account or member presenting the identification.
8. Other information on the identification is not consistent with readily accessible information that is on file with the federal credit union, such as a signature card or a recent check.
10. Personal identifying information provided is inconsistent when compared against external information sources used by the federal credit union. For example:
11. Personal identifying information provided by the member is not consistent with other personal identifying information provided by the member. For example, there is a lack of correlation between the SSN range and date of birth.
12. Personal identifying information provided is associated with known fraudulent activity as indicated by internal or third-party sources used by the federal credit union. For example:
13. Personal identifying information provided is of a type commonly associated with fraudulent activity as indicated by internal or third-party sources used by the federal credit union. For example:
a. The address on an application is fictitious, a mail drop, or prison; or
14. The SSN provided is the same as that submitted by other persons opening an account or other members.
15. The address or telephone number provided is the same as or similar to the address or telephone number submitted by an unusually large number of other persons opening accounts or by other members.
16. The person opening the covered account or the member fails to provide all required personal identifying information on an application or in response to notification that the application is incomplete.
17. Personal identifying information provided is not consistent with personal identifying information that is on file with the federal credit union.
18. For federal credit unions that use challenge questions, the person opening the covered account or the member cannot provide authenticating information beyond that which generally would be available from a wallet or consumer report.
b. The member fails to make the first payment or makes an initial payment but no subsequent payments.
23. Mail sent to the member is returned repeatedly as undeliverable although transactions continue to be conducted in connection with the member's covered account.
24. The federal credit union is notified that the member is not receiving paper account statements.
25. The federal credit union is notified of unauthorized charges or transactions in connection with a member's covered account.
Notice From Members, Victims of Identity Theft, Law Enforcement Authorities, or Other Persons Regarding Possible Identity Theft in Connection With Covered Accounts Held by the Federal Credit Union
26. The federal credit union is notified by a member, a victim of identity theft, a law enforcement authority, or any other person that it has opened a fraudulent account for a person engaged in identity theft.
[72 FR 63769, Nov. 9, 2007, as amended at 74 FR 22644, May 14, 2009; 76 FR 18365, Apr. 4, 2011]