FTC Issues Identity Theft Red Flag Rules Guidance

The Federal Trade Commission (“FTC”) has issued revised guidance designed to help businesses comply with the requirements of the Red Flags Rule, which protects consumers by requiring businesses to watch for and respond to warning signs or “red flags” of identity theft. The revised guidance, entitled Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business, outlines a two-step analysis to determine if an entity must comply with the Red Flags Rule. According to the Guide, “the determination isn’t based on the industry or sector, but rather on whether a business’s activities fall within the relevant definitions. A business must implement a written program only if it has covered accounts.” Businesses need to assess if they fall within the Red Flags Rule’s definitions of a “financial institution” or “creditor.” The second step requires a determination as to whether they have “covered accounts.”