On 10 April, the Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission (CFTC) adopted a joint “red flags” rule pursuant to the Dodd-Frank Wall Street Reform Act requiring financial institutions and creditors to develop and implement written identity theft prevention programmes. The new rule on identity theft prevention systems will become effective 30 days after publication in the Federal Register (publication anticipated in April 2013), and relevant entities will need to comply within 6 months of the rule becoming effective.