Identity Theft Red Flags Rules (Joint Final Rules; Fed. Reg. Version) (with Lofchie Comments)

The CFTC and SEC (collectively, the "Commissions") are jointly issuing final rules and guidelines to require certain regulated entities to establish programs to address risks of identity theft. These rules and guidelines implement provisions of the Dodd-Frank Act, which amended the Fair Credit Reporting Act and directed the Commissions to adopt rules requiring entities that are subject to the Commissions' respective enforcement authorities to address identity theft. First, the rules require financial institutions and creditors to develop and implement a written identity theft prevention program designed to detect, prevent, and mitigate identity theft in connection with certain existing accounts or the opening of new accounts. The rules include guidelines to assist entities in the formulation and maintenance of programs that would satisfy the requirements of the rules. Second, the rules establish special requirements for any credit and debit card issuers that are subject to the Commissions' respective enforcement authorities, to assess the validity of notifications of changes of address under certain circumstances.

Effective date: May 20, 2013.

Compliance date: November 20, 2013.

Lofchie Comments: If you read the compliance items of the last few days, including today's news item on the IOSCO study of market manipulation, it is becoming more and more clear that the compliance function requires substantial facility with technology.Separately, firms should be recognizing the increasing commonality among the compliance activities relating to identify theft, data security generally, and anti-money laundering. These compliance regimes overlap and are likely to become of higher profile.

See: Joint final rules and guidelines.See also: news story at the time of the rules' adoption by the Commissions: CFTC and SEC Approve Joint Final Rule Governing Identity Theft (with Lofchie Comment).