New SEC & CFTC Rules Regarding Identity Theft Programs For Private Fund Advisers

In 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") amended the Fair Credit Reporting Act ("FCRA") to add the Securities and Exchange Commission ("SEC") and the Commodity Futures Trading Commission ("CFTC") (together, the "Commissions") to the list of federal agencies that must jointly adopt and individually enforce identity theft red flags rules. Previously, entities registered with the Commissions were covered by the rules of other federal agencies.

In a recent release jointly issued by the Commissions, the SEC and CFTC set forth rules and guidelines requiring certain regulated entities to establish programs to address the risks of identity theft.¹ Although the Commissions' rules do not contain explicit requirements and do not expand the scope beyond what is already contained in the rules of other federal agencies, private fund advisers, including advisers to hedge funds, private equity funds, and real estate funds, should