On December 18, President Obama signed the Red Flag Program Clarification Act of 2010 (the Act). The Act clarifies the meaning of the term “creditor” under the Red Flags Rule (the Rule). Previously, the Rule broadly defined “creditor,” resulting in confusion about whether investment advisers that billed in arrears were required to comply with the Rule and create and implement comprehensive identity theft prevention programs.
The Act aims to curb the confusion. Under the new definition, the term “creditor” means an entity that regularly and in the ordinary course of business:
In addition to narrowing the definition, the Act explicitly excludes those creditors “that advance funds on behalf of a person for expenses incidental to a service provided by the creditor to that person.” This exclusion helps clarify that entities such as investment advisers, in the normal course of business, are not subject to the Rule. However, the Act also directs the FTC to expand the definition of creditor to those entities that offer or maintain accounts that are “subject to a reasonably foreseeable risk of identity theft.” This last provision will be the FTC’s call and could potentially include advisers. Until the agency affirmatively acts, however, it appears advisers will not need to comply with the Rule by the January 1, 2011 deadline.
- Obtains or uses consumer reports, directly or indirectly, in connection with a credit transaction;
- Furnishes information to consumer reporting agencies in connection with a credit transaction; or
- Advances funds to or on behalf of a person, based on an obligation of the person to repay the funds or repayable from a specific property pledged by or on behalf of a person.
For more on the Red Flags Rule, see our previous compliance alert here.