Complying with the Red Flags Rule

Don’t think that your dealership is immune to strict federal requirements for deterring identity theft. These requirements are called the “red flags rule.” A change in the law on Dec. 18, 2010 amended the definition of “creditor” and made the rules less burdensome for some companies. (The Red Flag Program Clarification Act of 2010)

Background: Literally billions of dollars are being lost each year by individuals and businesses due to rampant identity theft. To help combat this problem, the Federal Trade Commission (FTC) and federal banking agencies have combined to develop new requirements applying to a wide range of “financial institutions” and “creditors.” Under the so-called “red flags rule,” which falls under the Fair and Accurate Credit Transactions Act, these business entities must create an Identity Theft Prevention Program designed to detect potential thefts and stop them in their tracks.

For this purpose, the “financial institutions” covered by the red flags rule include banks, savings associations and other depositary institutions where a transaction account is being held on behalf of a consumer. The definition of a “creditor” is the same as it is under the Equal Credit Opportunity Act. It includes an individual or organization that:

• Obtains and uses consumer reports, directly or indirectly in connection with a credit transaction.
• Furnishes information to consumer reporting agencies.
• Advances funds to, or on behalf of, a person based on an obligation of the person to repay them.

If your business is required to develop an Identity Theft Prevention Program under the red flags rule, the program must contain “reasonable policies and procedures” for detecting, preventing and minimizing identity theft. Your business should be able to meet the following objectives.

• Identify relevant patterns, practices, and specific forms of activity that are “red flags” that could signal possible identity theft and incorporate these red flags into the program.
• Detect the red flags that have been incorporated into the program.
• Respond in appropriate fashion to any red flags that have been detected in order to prevent and mitigate identity theft.
• Ensure that the program is updated periodically to reflect changes in risks from identity theft.

The federal agencies working with the FTC on this project have issued guidelines to help financial institutions and creditors develop and implement an appropriate program. The guidelines feature several examples of red flags for businesses to watch out for. For example, an invalid Social Security number (SSN) provided by a consumer applying for a loan is considered to be a red flag (see right-hand box for more examples).

The red flags for your business depend on several factors such as the types of covered accounts you offer, how those accounts may be opened and accessed and your prior experience with identity theft. Failure to comply with the rule could lead to expensive civil penalties.

According to the FTC, the rules allow creditors “the opportunity to design and implement a program that is appropriate to their size and complexity, as well as the nature of their operations.”

Finally, among other provisions, the rules require users of consumer reports to develop reasonable policies and procedures to apply when they receive a notice of address discrepancy from a consumer reporting agency.

For more information: The Federal Trade Commission has set up a website with answers to frequently asked questions from businesses and organizations. Click here to access it.

Councilor, Buchanan & Mitchell (CBM) is a professional services firm delivering tax, accounting and business advisory expertise throughout the Mid-Atlantic region from offices in Bethesda, MD and Washington, DC.

Our firm provides the information in this e-newsletter for general guidance only, and does not constitute the provision of legal advice, tax advice, accounting services, investment advice, or professional consulting of any kind. The information provided herein should not be used as a substitute for consultation with professional tax, accounting, legal, or other competent advisers. Before making any decision or taking any action, you should consult a professional adviser who has been provided with all pertinent facts relevant to your particular situation. Tax articles in this e-newsletter are not intended to be used, and cannot be used by any taxpayer, for the purpose of avoiding accuracy-related penalties that may be imposed on the taxpayer. The information is provided “as is,” with no assurance or guarantee of completeness, accuracy, or timeliness of the information, and without warranty of any kind, express or implied, including but not limited to warranties of performance, merchantability, and fitness for a particular purpose.