FCRA / FACTA Red Flags

No changes recorded yet — we are watching, and nothing has been published.

1. 2018-12-11 FTC requests public comment on its Identity Theft Rules as part of its regulatory review
2. 2013-02-11 Interim final rule implementing the Red Flag Program Clarification Act takes effect
3. 2008-11-01 Mandatory compliance date set by the 2007 joint final rules
4. 2008-01-01 Joint final rules and guidelines take effect

1. 2012-12-06
   Red Flags Rule as amended December 2012 AmendmentCurrent text

   Interim final rule aligning the definition of "creditor" with the Red Flag Program Clarification Act of 2010; effective 11 February 2013. source

2. 2009-05-14
   Technical corrections (May 2009) Errata

   Technical corrections to the affiliate marketing, identity theft red flags and address discrepancy rules. source

3. 2007-11-09
   Joint final rules (November 2007) Major version

   Required each financial institution or creditor to run a written Identity Theft Prevention Program; effective 1 January 2008, with mandatory compliance from 1 November 2008. source

4. 2006-07-18
   Joint proposal (July 2006) Draft

   Joint notice of proposed rulemaking on identity theft red flags and address discrepancies. source

The rule applies to financial institutions and creditors under FTC jurisdiction that offer or maintain covered accounts.

Scope

Financial institutions and creditors subject to administrative enforcement of the FCRA by the FTC under 15 U.S.C. 1681s(a)(1). source

Covered accounts

Each must periodically determine, through a risk assessment, whether it offers or maintains covered accounts, considering how accounts are opened and accessed and its past experience with identity theft. source

Card issuers

Debit or credit card issuers must assess the validity of a change of address before issuing an additional or replacement card requested shortly after it. source

Creditor definition

The 2012 interim final rule made the definition of "creditor" consistent with the Red Flag Program Clarification Act of 2010. source

The institution writes, approves at board level and periodically updates its own Identity Theft Prevention Program.

Written program

The program must identify relevant red flags, detect them, respond to them and be updated periodically as risks change. source

Board approval

The initial written program must be approved by the board of directors or a board committee, and the board or senior management oversees it. source

Guidelines

The institution must consider the guidelines in Appendix A to part 681 and include those that are appropriate. source

The FTC enforces the rule under the Fair Credit Reporting Act.

FTC jurisdiction

The rule binds the entities subject to the FTC's administrative enforcement of the FCRA. source

1. Law text 16 CFR part 681 – Identity Theft Rules
2. Law text Joint final rules and guidelines (9 November 2007)
3. Law text Interim final rule implementing the Red Flag Program Clarification Act (6 December 2012)

1. FTC Safeguards Rule

   The Safeguards Rule requires a program to protect customer information generally; the Red Flags Rule targets detecting and responding to identity theft in covered accounts.

2. NYDFS Part 500

   NYDFS Part 500 requires a full cybersecurity program at New York-licensed financial firms; the Red Flags Rule is a narrower federal identity theft program.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to FCRA / FACTA Red Flags (RSS)