United StatesCFTC identity theft red flags rule
In force since .
A sensitive categories rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Governance, Security
As of .
What it requires
- This binds a financial institution or creditor subject to administrative enforcement of the Fair Credit Reporting Act by the Commodity Futures Trading Commission, which includes a futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, swap dealer or major swap participant that directly or indirectly holds a transaction account belonging to a consumer (17 CFR 162.30(a) and (b)(7)).
- Periodically determine whether you offer or maintain covered accounts, conducting a risk assessment that considers the methods you provide to open your accounts, the methods you provide to access them, and your previous experiences with identity theft (17 CFR 162.30(c)).
- If you offer or maintain one or more covered accounts, develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account, appropriate to your size and complexity and the nature and scope of your activities (17 CFR 162.30(d)(1)).
- Include in the program reasonable policies and procedures to identify relevant Red Flags, detect them, respond appropriately to them, and update the program periodically (17 CFR 162.30(d)(2)).
- Obtain approval of the initial written program from your board of directors or an appropriate committee, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements (17 CFR 162.30(e)).
- Consider the guidelines in the appendix to the subpart and include in the program those that are appropriate (17 CFR 162.30(f)).
These lines are LexLint's reading of the law's text, as of .
What this law does
The rule applies to a financial institution or creditor subject to administrative enforcement of the Fair Credit Reporting Act by the Commodity Futures Trading Commission. A financial institution includes any futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, swap dealer, or major swap participant that directly or indirectly holds a transaction account belonging to a consumer.
Each financial institution or creditor must periodically determine whether it offers or maintains covered accounts, and must conduct a risk assessment that considers the methods it provides to open its accounts, the methods it provides to access its accounts, and its previous experiences with identity theft.
Each financial institution or creditor that offers or maintains one or more covered accounts must develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account.
The Identity Theft Prevention Program must include reasonable policies and procedures to identify relevant Red Flags and incorporate them into the Identity Theft Prevention Program, detect them, respond appropriately to them to prevent and mitigate identity theft, and update the Identity Theft Prevention Program periodically.
The institution must obtain approval of the initial written Identity Theft Prevention Program from its board of directors or an appropriate committee of the board, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements. The rules were effective , with a compliance date of .
When LexLint raises it
When your app profile says your app provides financial services.