On 18 December 2010, the Red Flag Program Clarification Act of
2010 (RFPCA) was signed into law by President Obama.1
The RFPCA aims to narrow the universe of "creditors" that
must comply with the Fair Credit Reporting Act (FCRA) Identity
Theft Red Flags Rules, which require the maintenance of a written
Identity Theft Prevention Program.
The Federal Trade Commission (FTC) and federal banking
agencies2 jointly issued Red Flags Rules in
2007,3 with each agency's rule applicable to certain
types of entities under that agency's jurisdiction. The
FTC's rule applies to certain "financial
institutions" and "creditors" that are subject to
administrative enforcement of FCRA by the FTC.4 There
has been substantial uncertainty regarding whether certain entities
that clearly are not "financial institutions" could be
deemed to be "creditors" that would be covered by the
FTC's rule. The FTC had interpreted the term
"creditor" to apply very broadly, and stated that the
term could
