Just announced, the FTC will suspend enforcement of the Red Flags Rule again – this time until August 1, 2009 (resulting in an additional three month delay from its current compliance date of May 1, 2009). This suspension will give creditors more time to development and implement identity theft prevention programs. The FTC explained that this action results from the ongoing debate regarding whether the Red Flags Rule is too broad. This additional three month delay will allow industries and associations to share guidance with their members and provide Congress time to consider the issue further. During this time period, the FTC also has stated it will release a template to help entities that have a low risk of identity theft to comply with the law. The FTC will forebear from bringing any enforcement action for violation of the Rule during this additional three-month compliance period. The FTC’s announcement, however, makes clear that it applies only to entities subject to its jurisdiction and does not affect the other agencies charged with overseeing enforcement of this Rule, the Office of the Comptroller of the Currency, Federal Reserve Board, Federal Deposit Insurance Corporation, Office of Thrift Supervision, and the National Credit Union Administration.

The Red Flags Rule resulted from the Fair and Accurate Credit Transactions Act of 2003, which amended the Fair Credit Reporting Act, and requires covered entities to develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft. The FTC explained that many entities subject to the Rule were uncertain about their coverage under the Red Flags Rule. During the first extension period, the FTC conducted outreach efforts and developed and published materials to help explain what types of entities are covered.

If you have questions or would like copies of previous advisories related to this topic, please contact David Anthony. Troutman Sanders LLP offers a full array of services to help bring companies into compliance with the Red Flags Rule.