SEC and CFTC Mandate Strict Identity Theft Prevention Compliance

On April 10, the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) (together, the Commissions) jointly adopted rules and guidelines that require certain entities subject to their enforcement authorities to develop compliance programs to protect investors from identity theft. ^[1] The new Identity Theft Red Flags Rules, adopted pursuant to the Dodd-Frank Act, which amends the Fair Credit Reporting Act (FCRA), are similar to existing identity theft rules enforced by the Federal Trade Commission (FTC) and federal banking regulators.

The Red Flags Rules require "financial institutions" ^[2] and "creditors" ^[3] that hold certain covered accounts to develop and implement a written identity theft prevention program. The program must provide for identification and detection of and responses to patterns, practices or specific activities -- known as "red flags" -- that could indicate identity theft.