FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule

The Federal Trade Commission (FTC) has announced that it is delaying the enforcement of its Red Flags Rule until Dec. 31, 2010. The decision was made at the request of several members of Congress. Meanwhile, Congress is considering legislation that would change the scope of entities covered by the rule.

The announcement and the release of an enforcement policy statement do not affect other federal agencies’ enforcement of the original Nov. 1, 2008, deadline for institutions subject to their compliance oversight, according to the FTC.

“Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule—and to fix this problem quickly,” Jon Leibowitz, FTC chairman, says. “We appreciate the efforts of Congressmen Barney Frank and John Adler for getting a clarifying measure passed in the House and hope action in the Senate will be swift,” he adds.

The rule was developed under the Fair and Accurate Credit Transactions Act (FACTA), in which Congress directed the FTC and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft. The resulting Red Flags Rule requires all such entities that have “covered accounts” to develop and implement written programs to identify, detect and respond to patterns, practices or activities that could indicate identity theft.

The rule became effective Jan. 1, 2008, with full compliance for all covered entities originally required by Nov. 1, 2008. The commission has issued several enforcement delays. Most recently, the commission announced in October 2009 that at the request of certain congressmen, it was delaying enforcement of the rule until June 1, 2010, to allow Congress time to finalize legislation that would limit the scope of business covered by the rule.