Phone: 630-495-2282 Fax: 630-495-2260 Map/Directions

How's compliance coming with the Red Flags Rules? Deadline is May 1

November 15, 2010

Businesses caught a reprieve last fall when the Federal Trade Commission suspended enforcement of the new "Red Flag Rules" until May 1, to give creditors and financial institutions more time to develop and implement written Identity Theft Prevention Programs.

For area dealers who were not ready for the Nov. 1 deadline, it is hoped they haven’t spent the six-month extension with their feet on their desks.

The Red Flags Rules — named after the symbol of a warning of possible trouble — are a sequel to the Safeguards Rule, issued by the FTC in 1999.

The older regulation aims to prevent the theft of customers’ credit data from businesses such as dealerships. Paul Metrey, director of regulatory affairs at the NADA, said dealerships can comply with the regulation by working with their lawyers.

An NADA guide to help dealers with Red Flags compliance is available at The cost of obeying the rule will depend on a dealership’s size and complexity, Metrey told Automotive News in September. "This is not a one-size-fits-all requirement," he said.

However, there are bright spots to consider for dealers who feel overwhelmed or annoyed by yet another compliance burden:

Having a written Identity Theft Prevention Program can increase the likelihood that employees will more consistently follow policies and procedures the dealership already has in place to help ward off identity theft and fraud.

Also, although dealers must carefully analyze their operations and prepare an ITPP that is specifically tailored to their respective businesses, "the task is not insurmountable and dealers should not automatically conclude that they must expend significant sums of money to achieve compliance," said Metrey.

Dealer compliance includes:

• Conducting a preliminary risk assessment
• Constructing a written ITPP
• Knowing the indicators of identity theft (Red Flags) and how to respond to them
• Training requirements
• Obtaining service provider oversight
• Involving a dealership’s board of directors

The new Rule forces "financial institutions" and "creditors" to comply with the Rule. Dealerships are swept up in the matter because the FTC defines dealers as creditors.

In summary, if a dealer can’t form a reasonable belief under his ITPP that a credit report relates to the customer before him, the transaction must be stopped.