The Federal Trade Commission announced it will delay enforcement of the new “Red Flags Rule” another three months -- until August 1, 2009 -- to give creditors and financial institutions more time to develop and implement written identity theft prevention programs.
The FTC also said it would soon release a template to help entities that have a low risk of identity theft, such as businesses that know their customers personally, comply with the law.
On Oct. 14, 2008, the Department of Education announced that the "Red Flags Rules" apply to institutions participating in the Federal Perkins Loan Program and may apply to other credit programs administered by an institution. The rule states that "creditors" holding "covered accounts" must comply with the law. The rules have a broad definition of "creditors" and "covered accounts" that is applicable to many colleges.
This is the second time that the FTC has delayed enforcement of the regulations that require financial institutions and creditors to develop and implement a written identity theft prevention program to detect, prevent, and respond to patterns, practices, or specific activities that may indicate identity theft. The regulations were included in the Fair and Accurate Credit Transactions Act (FACT Act) and institutions were expected to be in compliance by Nov. 1, 2008, but the FTC suspended enforcement until May 1, 2009. The initial six-month delay was designed to give creditors and financial institutions additional time to develop and implement written identity theft prevention programs.
“Given the ongoing debate about whether Congress wrote this provision too broadly, delaying enforcement of the Red Flags Rule will allow industries and associations to share guidance with their members, provide low-risk entities an opportunity to use the template in developing their programs, and give Congress time to consider the issue further,” FTC Chairman Jon Leibowitz said.
Naomi Lefkovitz, an attorney in the FTC's Division of Privacy and Identity Protection, said that institutions will generally be subject to "Red Flag" requirements if they loaning out money and collecting it. If an institution is a "creditor" it must then determine if it is holding "covered accounts" - a consumer account that involves multiple payments or transactions (a loan that is billed or payable monthly).
Under this definition, the following activities could make institutions a "creditor" with "covered accounts:"
- participating in the Federal Perkins Loan program,
- participating as a school lender in the FFELP,
- offering institutional loans to students, faculty, or staff, or
- offering an extended tuition payment plan throughout the semester instead of requiring full payment at the beginning of the semester.
Red Flags Rules Resources
By Haley Chitty
NASFAA Director of Communications
Posted 05/05/09 to www.NASFAA.org. Redistribution to non-NASFAA institutions is prohibited. Please submit Web Site questions or comments to Web@NASFAA.org.
