Definition

• The Red Flag law went into full effect in 2008. This law, developed by the FTC, the National Credit Union Administration and federal bank regulatory agencies, requires that companies that extend credit and financial institutions have a written plan to prevent identity theft. This is part of the the Fair and Accurate Credit Transactions (FACT) Act of 2003.
  
  

Who Must Comply

• Compliance is required by all financial institutions and extenders of credit carrying covered accounts. Financial institutions are banks, credit unions, savings and loan institutions and anyone offering transactional accounts. Transactional examples are checking, savings and/or shared draft accounts.
  
  

Prevention/Solution

• The Red Flag law requires the organizations to have a written identity theft prevention document that addresses at least five of the 26 warning signs that someone's identity may have been compromised. Some examples include opening too many accounts at once, questionable documents and addresses that aren't up to date or are not residential.
  
  

More Requirements

• The FTC also requires that the organizations not only have a written plan, but also have responses to the warning signs in place. Which warning signs and responses the organizations use depends upon their size, scope and clientèle.
  
  

Oversight

• The Red Flag rules require that senior level executives and the board of directors oversee the program. They must then train their employees and implement the policy in the organization.