United StatesRegulation S-ID: identity theft red flags program (SEC)
In force since .
A sensitive categories rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Governance, Security
As of .
What it requires
- This binds a financial institution or creditor that is a broker, dealer or other person registered or required to be registered under the Securities Exchange Act of 1934, an investment company registered or required to be registered under the Investment Company Act of 1940, or an investment adviser registered or required to be registered under the Investment Advisers Act of 1940 (17 CFR 248.201(a)).
- Periodically determine whether you offer or maintain covered accounts, conducting a risk assessment that considers the methods you provide to open your accounts, the methods you provide to access them, and your previous experiences with identity theft (17 CFR 248.201(c)).
- If you offer or maintain one or more covered accounts, develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account, appropriate to your size and complexity and the nature and scope of your activities (17 CFR 248.201(d)(1)).
- Include in the program reasonable policies and procedures to identify relevant Red Flags, detect them, respond appropriately to them, and update the program periodically (17 CFR 248.201(d)(2)).
- Obtain approval of the initial written program from your board of directors or an appropriate committee, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements (17 CFR 248.201(e)).
- Consider the guidelines in the appendix to the subpart and include in the program those that are appropriate (17 CFR 248.201(f)).
These lines are LexLint's reading of the law's text, as of .
What this law does
The rule applies to a financial institution or creditor that is a broker, dealer or other person registered or required to be registered under the Securities Exchange Act of 1934, an investment company registered or required to be registered under the Investment Company Act of 1940, or an investment adviser registered or required to be registered under the Investment Advisers Act of 1940.
Each financial institution or creditor must periodically determine whether it offers or maintains covered accounts, and must conduct a risk assessment that considers the methods it provides to open its accounts, the methods it provides to access its accounts, and its previous experiences with identity theft.
Each financial institution or creditor that offers or maintains one or more covered accounts must develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account.
The Program must include reasonable policies and procedures to identify relevant Red Flags and incorporate them into the Program, detect them, respond appropriately to them to prevent and mitigate identity theft, and update the Program periodically.
The institution must obtain approval of the initial written Program from its board of directors or an appropriate committee of the board, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements. The rules were effective , with a compliance date of .
When LexLint raises it
When your app profile says your app is a securities firm.