Today, the Federal Trade Commission (FTC) has extended the enforcement deadline of the Red Flags Rule to November 1, 2009. The Rule requires "financial institutions" and "creditors" that hold certain accounts to take measures to combat identity theft. These measures include the development and implementation of a written identity theft prevention program to detect, prevent and mitigate identity theft. Due to the regulation's expansive definition of "creditor," many entities, including healthcare providers, retailers, auto dealers and public utilities, were unaware of the Rule's broad applicability. The regulation defines "creditor" to include any business offering personal credit to consumers, including businesses that offer deferred payment and payment plans.
According to the July 29, 2009, press release, the House Appropriations Committee had requested the FTC to "defer enforcement in conjunction with additional efforts to minimize the burdens of the Rule on healthcare providers and small businesses with a low risk of identity theft problems." This delay is one of many in a series of enforcement postponements. Enforcement of the Rule was previously deferred from the original date of November 1, 2008, to May 1, 2009, to August 1, 2009, and now, a year after the original deadline, to November 1, 2009.
The FTC acknowledges that "some [entities] -- particularly small businesses and entities with a low risk of identity theft -- remain uncertain about their obligations" and has stated that it will make available additional compliance guidance to help them. The guidance, which will be "available shortly," includes a link for small and low-risk businesses on the Red Flags Rule website. FTC staff will embark on an expanded education campaign to inform small businesses and other entities about compliance with this Rule.
The FTC believes that the deadline extension, paired with the additional guidance, will enable businesses to better understand and comply with the Rule. The FTC's enforcement delay does not affect other federal agencies' enforcement of the initial November 1, 2008, deadline for institutions subject to their oversight.