Your Institution’s Program for Fighting Identity Theft

Federal regulations issued under the FACT Act require most financial institutions to maintain a program to combat identity theft. This requirement has a mandatory compliance date of November 1, 2008. A financial institution is subject to this requirement if it offers “covered accounts.” The term “covered account” includes most consumer deposit and loan accounts. It also includes any other account, such as a business account, for which there is a “reasonably foreseeable risk” to customers or to the financial institution itself from identity theft.

Financial institutions are required to periodically determine whether or not they offer any covered accounts. If a financial institution offers a covered account, it must have an identity theft program.

The identity theft program must include four components.
  • The program must identify “red flags” that signal identity theft. Red flags are essentially warning signals of identity theft.
  • The program must spell out how the institution will detect identity theft red flags that occur.
  • The program must state how the institution will respond when it encounters a red flag and how it will act to prevent identity theft or mitigate its consequences.
  • The program must include procedures for updating itself to account for changes in risk from identity theft.

In creating its program, an institution must take into account guidelines that are set forth in the federal identity theft regulations. These are guidelines that help an institution to implement the four components listed above. You can find these guidelines as an appendix to the agencies’ regulations. The citations are printed below.

The institution’s board of directors must be involved in the development and implementation of the identity theft program. The board of directors must also approve the program. The board can delegate this responsibility to an appropriate committee.

The institution must also provide for employee training sufficient to implement the program.

Finally, the institution must exercise oversight of service provider arrangements. In other words, the institution must account for the risk of identity theft that would arise through the use of service providers.

Here are the citations to the agencies’ regulations:

  • 12 CFR 41.90—OCC
  • 12 CFR 222.90—FRB
  • 12 CFR 334.90—FDIC
  • 12 CFR 717.90—NCUA