Source: https://www.ecfr.gov/cgi-bin/text-idx?mc=true&node=pt12.1.41&rgn=div5
Timestamp: 2020-08-03 09:54:30
Document Index: 482105824

Matched Legal Cases: ['art 41', 'ART 41', '§41', '§41', '§41', '§41', '§41', 'art 41', 'art 41', 'art 30', '§41', '§41', '§41', '§41', '§41']

Title 12 → Chapter I → Part 41
PART 41—FAIR CREDIT REPORTING
Subparts A-H [Reserved]
Subpart I—Proper Disposal of Records Containing Consumer Information
§§41.80-41.82 [Reserved]
§41.83 Proper disposal of records containing consumer information.
Subpart J—Identity Theft Red Flags
§41.90 Duties regarding the detection, prevention, and mitigation of identity theft.
§41.91 Duties of card issuers regarding changes of address.
§41.92 Examples.
Appendixes A-I to Part 41 [Reserved]
Appendix J to Part 41—Interagency Guidelines on Identity Theft Detection, Prevention, and Mitigation
Authority: 12 U.S.C. 1 et seq., 24(Seventh), 93a, 1462a, 1463, 1464, 1818, 1828, 1831p-1, 1881-1884, and 5412(b)(2)(B); 15 U.S.C. 1681m, 1681s, 1681t, and 1681w.
Source: 69 FR 77616, Dec. 28, 2004, unless otherwise noted.
(a) Definitions as used in this section. (1) Consumer means an individual.
(2) Federal savings association means a Federal savings association or an operating subsidiary of a Federal savings association.
(3) National bank means a national bank, an operating subsidiary of a national bank, or a Federal branch or agency of a foreign bank.
(b) In general. Each national bank or Federal savings association must properly dispose of any consumer information that it maintains or otherwise possesses in accordance with the Interagency Guidelines Establishing Information Security Standards, as set forth in appendix B to 12 CFR part 30, to the extent that the bank or savings association is covered by the scope of the Guidelines.
(c) Rule of construction. Nothing in this section shall be construed to:
(1) Require a national bank or Federal savings association to maintain or destroy any record pertaining to a consumer that is not imposed under any other law; or
[79 FR 28400, May 16, 2014]
Source: 72 FR 63753, Nov. 9, 2007, unless otherwise noted.
(a) Scope. This section applies to a financial institution or creditor that is a national bank; a Federal savings association; a Federal branch or agency of a foreign bank; or an operating subsidiary of any of these institutions that is not a functionally regulated subsidiary within the meaning of section 5(c)(5) of the Bank Holding Company Act of 1956, as amended (12 U.S.C. 1844(c)(5)).
(b) Definitions. For purposes of this section and appendix J, the following definitions apply:
(8) Identity theft has the same meaning as in 12 CFR 1022.3(h).
(9) Person means any individual, partnership, corporation, trust, estate, cooperative, association, government, or governmental subdivision or agency, or other entity.
(10) Red Flag means a pattern, practice, or specific activity that indicates the possible existence of identity theft.
(11) Service provider means a person that provides a service directly to the financial institution or creditor.
(f) Guidelines. Each financial institution or creditor that is required to implement a Program must consider the guidelines in appendix J of this part and include in its Program those guidelines that are appropriate.
[72 FR 63753, Nov. 9, 2007, as amended at 79 FR 28400, May 16, 2014]
(a) Scope. This section applies to an issuer of a debit or credit card (card issuer) that is a national bank; a Federal savings association; a Federal branch or agency of a foreign bank; or an operating subsidiary of any of these institutions that is not a functionally regulated subsidiary within the meaning of section 5(c)(5) of the Bank Holding Company Act of 1956, as amended (12 U.S.C. 1844(c)(5)).
(3) Consumer means an individual.
(2) Otherwise assesses the validity of the change of address in accordance with the policies and procedures the card issuer has established pursuant to §41.90 of this part.
[72 FR 63753, Nov. 9, 2007, as amended at 79 FR 28401, May 16, 2014]
The examples in appendix J and supplement A to appendix J are not exclusive. Compliance with an example, to the extent applicable, constitutes compliance with this subpart. Examples in a paragraph illustrate only the issue described in the paragraph and do not illustrate any other issue that may arise in this subpart.
[79 FR 28401, May 16, 2014]
Section 41.90 of this part requires each financial institution and creditor that offers or maintains one or more covered accounts, as defined in §41.90(b)(3) of this part, to develop and provide for the continued administration of a written Program to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. These guidelines are intended to assist financial institutions and creditors in the formulation and maintenance of a Program that satisfies the requirements of §41.90 of this part.
(c) Categories of Red Flags. The Program should include relevant Red Flags from the following categories, as appropriate. Examples of Red Flags from each of these categories are appended as supplement A to this appendix J.
(a) Obtaining identifying information about, and verifying the identity of, a person opening a covered account, for example, using the policies and procedures regarding identification and verification set forth in the Customer Identification Program rules implementing 31 U.S.C. 5318(l); and
(2) Reviewing reports prepared by staff regarding compliance by the financial institution or creditor with §41.90 of this part; and
(b) Reports. (1) In general. Staff of the financial institution or creditor responsible for development, implementation, and administration of its Program should report to the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management, at least annually, on compliance by the financial institution or creditor with §41.90 of this part.
Supplement A to Appendix J
In addition to incorporating Red Flags from the sources recommended in section II.b. of the Guidelines in appendix J of this part, each financial institution or creditor may consider incorporating into its Program, whether singly or in combination, Red Flags from the following illustrative examples in connection with covered accounts:
3. A consumer reporting agency provides a notice of address discrepancy, as defined in 12 CFR 1022.82(b) of this part.
[72 FR 63754, Nov. 9, 2007, as amended at 74 FR 22642, May 14, 2009; 76 FR 6688, Feb. 8, 2011; 79 FR 28401, May 16, 2014]