The SEC And CFTC Joint Identity Theft Red Flags Rule

Introduced in 2003 by amendment to the Fair Credit Reporting Act of 1970 (FCRA), the identity theft red flags rule (Red Flags Rule) required the Federal Trade Commission (FTC) to issue rules that require certain regulated entities to implement programs designed to detect against, prevent and mitigate identity theft. In 2007, the FTC released the first Red Flags Rule, which was written so that the FTC could enforce the rule on entities regulated by the Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission (CFTC). Then, in 2010, the Dodd-Frank Act amended the FCRA, requiring other agencies, including the SEC and CFTC, to take over for the FTC and enforce their own version of the Red Flags Rule on their respective regulated entities.