Source: https://www.ecfr.gov/cgi-bin/text-idx?mc=true&node=pt17.2.162&rgn=div5
Timestamp: 2020-07-04 02:46:56
Document Index: 366434062

Matched Legal Cases: ['art 162', '§162', '§162', '§162', '§162', '§162', '§162', '§162', '§162', '§162', '§162', '§162', '§162', '§162', '§162', 'art 162', '§1', '§162', '§162', '§162', '§162', '§162', '§162', '§162', '§162']

Title 17 → Chapter I → Part 162
§162.1 Purpose and scope.
§162.2 Definitions.
§162.3 Affiliate marketing opt out and exceptions.
§162.4 Scope and duration of opt out.
§162.5 Contents of opt-out notice; consolidated and equivalent notices.
§162.6 Reasonable opportunity to opt out.
§162.7 Reasonable and simple methods of opting out.
§162.8 Acceptable delivery methods of opt-out notices.
§162.9 Renewal of opt out.
§§162.10-162.20 [Reserved]
§162.21 Proper disposal of consumer information.
Subpart C—Identity Theft Red Flags
§162.30 Duties regarding the detection, prevention, and mitigation of identity theft.
§162.31 [Reserved]
§162.32 Duties of card issuers regarding changes of address.
Appendix B to Part 162—Interagency Guidelines on Identity Theft Detection, Prevention, and Mitigation
Source: 76 FR 43884, July 22, 2011, unless otherwise noted.
(e) Concise—(1) In general. The term “concise” means a reasonably brief expression or statement.
(i) Dispose or Disposal—(1) In general. The terms “dispose” or “disposal” means:
(d) Making solicitations—(1) When a solicitation occurs. A covered affiliate makes a solicitation for marketing purposes if the person—
(a) Contents of the opt-out notice—(1) In general. An opt-out notice must be in writing, be clear and conspicuous, as well as concise, and must accurately disclose the following:
(b) Electronic notices. For opt-out notices provided electronically, the notice may be provided in compliance with either the electronic disclosure provisions in §1.4 of this title or the provisions in section 101 of the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. 7001 et seq.
(a) Renewal notice and opt-out requirement—(1) In general. Since the FCRA provides that opt-out elections can expire in a period of no less than five years, an affiliate that has or previously had a pre-existing business relationship with a consumer must provide a renewal notice to the consumer after such time in order to allow its affiliates to make solicitations. After the opt-out election period expires, its affiliates may make solicitations unless:
(i) The consumer has been given a renewal notice that complies with the requirements of this section and §§162.6 through 162.8 of this subpart, and a reasonable opportunity and a reasonable and simple method to renew the opt-out election, and the consumer does not renew the opt out; or
(2) Renewal period. Each opt-out renewal must be effective for a period of at least five years as provided in §162.4(b) of this subpart.
Source: 78 FR 23661, Apr. 19, 2013, unless otherwise noted.
(b) Special definitions for this subpart. For purposes of this section, and appendix B to this part, the following definitions apply:
(4) Credit has the same meaning in Sec. 603(r)(5) of the FCRA, 15 U.S.C. 1681a(r)(5).
(5) Creditor has the same meaning as in 15 U.S.C. 1681m(e)(4), and includes any futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, swap dealer, or major swap participant that regularly extends, renews, or continues credit; regularly arranges for the extension, renewal, or continuation of credit; or in acting as an assignee of an original creditor, participates in the decision to extend, renew, or continue credit.
(7) Financial institution has the same meaning as in 15 U.S.C. 1681a(t) and includes any futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, swap dealer, or major swap participant that directly or indirectly holds a transaction account belonging to a consumer.
(c) Periodic identification of covered accounts. Each financial institution or creditor must periodically determine whether it offers or maintains covered accounts. As a part of this determination, a financial institution or creditor shall conduct a risk assessment to determine whether it offers or maintains covered accounts described in paragraph (b)(3)(ii) of this section, taking into consideration:
(d) Establishment of an Identity Theft Prevention Program—(1) Program requirement. Each financial institution or creditor that offers or maintains one or more covered accounts must develop and implement a written Identity Theft Prevention Program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. The Identity Theft Prevention Program must be appropriate to the size and complexity of the financial institution or creditor and the nature and scope of its activities.
(2) Elements of the Identity Theft Prevention Program. The Identity Theft Prevention Program must include reasonable policies and procedures to:
(e) Administration of the Identity Theft Prevention Program. Each financial institution or creditor that is required to implement an Identity Theft Prevention Program must provide for the continued administration of the Identity Theft Prevention Program and must:
(f) Guidelines. Each financial institution or creditor that is required to implement an Identity Theft Prevention Program must consider the guidelines in appendix B of this part and include in its Identity Theft Prevention Program those guidelines that are appropriate.
(a) Scope. This section applies to a person described in §162.30(a) that issues a debit or credit card (card issuer).
(b) Definition of cardholder. For purposes of this section, a cardholder means a consumer who has been issued a credit or debit card.
(2) Otherwise assesses the validity of the change of address in accordance with the policies and procedures the card issuer has established pursuant to §162.30.
Section 162.30 requires each financial institution or creditor that offers or maintains one or more covered accounts, as defined in §162.30(b)(3), to develop and provide for the continued administration of a written Identity Theft Prevention Program to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. These guidelines are intended to assist financial institutions and creditors in the formulation and maintenance of an Identity Theft Prevention Program that satisfies the requirements of §162.30.
I. The Identity Theft Prevention Program
In designing its Identity Theft Prevention Program, a financial institution or creditor may incorporate, as appropriate, its existing policies, procedures, and other arrangements that control reasonably foreseeable risks to customers or to the safety and soundness of the financial institution or creditor from identity theft.
(c) Categories of Red Flags. The Identity Theft Prevention Program should include relevant Red Flags from the following categories, as appropriate. Examples of Red Flags from each of these categories are appended as Supplement A to this Appendix B.
The Identity Theft Prevention Program's policies and procedures should address the detection of Red Flags in connection with the opening of covered accounts and existing covered accounts, such as by:
(a) Obtaining identifying information about, and verifying the identity of, a person opening a covered account; and
The Identity Theft Prevention Program's policies and procedures should provide for appropriate responses to the Red Flags the financial institution or creditor has detected that are commensurate with the degree of risk posed. In determining an appropriate response, a financial institution or creditor should consider aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a customer's account records held by the financial institution or creditor, or third party, or notice that a customer has provided information related to a covered account held by the financial institution or creditor to someone fraudulently claiming to represent the financial institution or creditor or to a fraudulent Internet Web site. Appropriate responses may include the following:
V. Updating the Identity Theft Prevention Program
Financial institutions and creditors should update the Identity Theft Prevention Program (including the Red Flags determined to be relevant) periodically, to reflect changes in risks to customers or to the safety and soundness of the financial institution or creditor from identity theft, based on factors such as:
VI. Methods for Administering the Identity Theft Prevention Program
(a) Oversight of Identity Theft Prevention Program. Oversight by the board of directors, an appropriate committee of the board, or a designated senior management employee should include:
(1) Assigning specific responsibility for the Identity Theft Prevention Program's implementation;
(2) Reviewing reports prepared by staff regarding compliance by the financial institution or creditor with §162.30; and
(3) Approving material changes to the Identity Theft Prevention Program as necessary to address changing identity theft risks.
(b) Reports. (1) In general. Staff of the financial institution or creditor responsible for development, implementation, and administration of its Identity Theft Prevention Program should report to the board of directors, an appropriate committee of the board, or a designated senior management employee, at least annually, on compliance by the financial institution or creditor with §162.30.
(2) Contents of report. The report should address material matters related to the Identity Theft Prevention Program and evaluate issues such as: The effectiveness of the policies and procedures of the financial institution or creditor in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts; service provider arrangements; significant incidents involving identity theft and management's response; and recommendations for material changes to the Identity Theft Prevention Program.
Supplement A to Appendix B
In addition to incorporating Red Flags from the sources recommended in section II(b) of the Guidelines in Appendix B of this part, each financial institution or creditor may consider incorporating into its Identity Theft Prevention Program, whether singly or in combination, Red Flags from the following illustrative examples in connection with covered accounts:
3. A consumer reporting agency provides a notice of address discrepancy, as defined in Sec. 603(f) of the Fair Credit Reporting Act (15 U.S.C. 1681a(f)).
18. For financial institutions or creditors that use challenge questions, the person opening the covered account or the customer cannot provide authenticating information beyond that which generally would be available from a wallet or consumer report.
[78 FR 23660, Apr. 19, 2013]