[Federal Register Volume 77, Number 235 (Thursday, December 6, 2012)]
[Rules and Regulations]
[Pages 72712-72715]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2012-29430]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
16 CFR Part 681
RIN 3084-AA94
Identity Theft Red Flags and Address Discrepancies Under the Fair
and Accurate Credit Transactions Act of 2003, as Amended by the Red
Flag Program Clarification Act of 2010
AGENCY: Federal Trade Commission.
ACTION: Interim final rule; request for comment.
-----------------------------------------------------------------------
SUMMARY: The Federal Trade Commission (``FTC'' or ``Commission'') is
amending its Red Flags Rule promulgated under Section 615 of the Fair
Credit Reporting Act (FCRA), to implement the Red Flag Program
Clarification Act of 2010 (Clarification Act or Act). The interim final
rule amends the definition of ``creditor'' in the original Red Flags
Rule to make it consistent with the revised definition of that term in
the Clarification Act.
DATES: The interim final rule is effective on February 11, 2013.
Written comments must be received on or before February 11, 2013.
ADDRESSES: Interested parties may file a comment online or on paper, by
following the instructions in the Request for Comments part of the
SUPPLEMENTARY INFORMATION section below. Write ``Red Flags Interim
Final Rule'' on your comment, and file your comment online at https://ftcpublic.commentworks.com/ftc/redflagsinterimrule by following the
instructions on the web-based form. If you prefer to file your comment
on paper, mail or deliver your comment to the following address:
Federal Trade Commission, Office of the Secretary, Room H-113 (Annex
M), 600 Pennsylvania Avenue NW., Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT: Steven Toporoff, Attorney, or Tiffany
George, Attorney, Federal Trade Commission, Division of Privacy and
Identity Protection, Bureau of Consumer Protection, (202) 326-2252, 600
Pennsylvania Avenue NW., Washington, DC 20580.
SUPPLEMENTARY INFORMATION:
[[Page 72713]]
I. Introduction
On November 9, 2007, the Commission and banking agencies published
final rules and guidelines \1\ to implement the red flags provisions of
section 615 of the FCRA.\2\ Section 615 directed the Commission and
banking agencies to issue joint regulations and guidelines requiring
``financial institutions'' and ``creditors'' to develop and implement a
written identity theft program to identify, detect, and respond to
possible risks of identity theft relevant to them.
---------------------------------------------------------------------------
\1\ 72 FR 63718 (Nov. 9, 2007). Office of Comptroller of the
Currency (OCC), Board of Governors of the Federal Reserve System
(Board), Federal Deposit Insurance Corporation (FDIC), National
Credit Union Administration (NCUA), Office of Theft Supervision
(OTS) (collectively ``banking agencies''), and the Federal Trade
Commission issued Red Flags Rules in a joint rulemaking. In addition
to these agencies, the Commodity Futures Trading Commission (CFTC)
and the Securities and Exchange Commission (SEC) obtained rulemaking
authority under section 615 of the FCRA, as amended by the Dodd
Frank Wall Street Reform and Consumer Protection Act, Public Law
111-203; 124 Stat. 1376-2223 (2010).
\2\ 15 U.S.C. 1681m(e).
---------------------------------------------------------------------------
The final Commission rule (the Red Flags Rule) \3\ included the
definition of ``creditor,'' as set forth in section 603(r)(5) of the
FCRA.\4\ That definition references the definition of ``creditor'' in
section 702 of the Equal Credit Opportunity Act (ECOA). The ECOA
defines the term ``creditor'' broadly as ``any person who regularly
extends, renews, or continues credit; any person who regularly arranges
for the extension, renewal, or continuation of credit; or any assignee
of an original creditor who participates in the decision to extend,
renew or continue credit.'' \5\ The ECOA further defines ``credit'' as
``the right granted by a creditor to a debtor to defer payment of debt
or to incur debts and defer its payment or to purchase property or
services and defer payment therefor.'' \6\
---------------------------------------------------------------------------
\3\ See also OCC, 12 CFR 41.90 and 171.90; Board, 12 CFR 222.90;
FDIC, 12 CFR 334.90; NCUA, 12 CFR 717.90; FTC, 16 CFR 681.1.
\4\ 15 U.S.C. 1681a(r)(5).
\5\ 15 U.S.C. 1691a(e).
\6\ 15 U.S.C. 1691a(d). Regulation B, promulgated under the
ECOA, defines ``credit'' in similar terms: ``the right granted by a
creditor to an applicant to defer payment of a debt, incur debt and
defer its payment, or purchase property or services and defer
payment therefor.'' 12 CFR 202.2(j).
---------------------------------------------------------------------------
The final rule, therefore, defined the term ``creditor'' in this
manner. The definition included businesses or organizations that
regularly provide goods or services first and allow consumers to pay
later.\7\ It also covered businesses or organizations that regularly
grant loans, arrange for loans or the extension of credit, or make
credit decisions, as well as those who regularly participate in the
decision to extend, renew, or continue credit, including setting the
terms of credit.\8\
---------------------------------------------------------------------------
\7\ For example, motor vehicle dealers and providers of
telecommunications services may provide goods or services in advance
and allow consumers to pay later. See 72 FR at 63741.
\8\ ``[E]ntities under FTC's jurisdiction covered by [section
615 of the FCRA] include State-chartered credit unions, non-bank
lenders, mortgage brokers, automobile dealers, utility companies,
telecommunications companies, and any other person that regularly
participates in a credit decision, including setting the terms of
credit.'' 72 FR at 63750.
---------------------------------------------------------------------------
II. The Red Flag Program Clarification Act
In December 2010, Congress enacted the Red Flag Program
Clarification Act (Clarification Act), 15 U.S.C. 1681m(e)(4), which
narrows the scope of entities covered as ``creditors'' under the Red
Flags Rule.\9\ The Clarification Act retains the ECOA definition of
``creditor,'' but generally limits the application of the Red Flags
Rule to those ECOA creditors that regularly and in the ordinary course
of business engage in at least one of the following three types of
conduct: \10\
---------------------------------------------------------------------------
\9\ Public Law 111-319, 124 Stat. 3457 (Dec. 18, 2010). The
Clarification Act does not modify the definition of the term
``financial institution,'' nor does it amend any of the substantive
requirements of the Red Flags Rule.
\10\ The Clarification Act does not create any industry-wide
exemptions: whether any particular entity is covered by the Rule
must be determined by that entity's specific conduct.
---------------------------------------------------------------------------
1. Obtain or use consumer reports, directly or indirectly, in
connection with a credit transaction; \11\ or
---------------------------------------------------------------------------
\11\ 15 U.S.C. 1681m(e)(4)(A)(i).
---------------------------------------------------------------------------
2. Furnish information to consumer reporting agencies in connection
with a credit transaction; \12\ or
---------------------------------------------------------------------------
\12\ 15 U.S.C. 1681m(e)(4)(A)(ii).
---------------------------------------------------------------------------
3. Advance funds to or on behalf of a person, based on an
obligation of the person to repay the funds or repayable from specific
property pledged by or on behalf of the person.\13\
---------------------------------------------------------------------------
\13\ 15 U.S.C. 1681m(e)(4)(A)(iii). As explained further below,
the Clarification Act further provides that ``advancing funds'' does
not include a creditor that advances funds on behalf of a person for
expenses incidental to a service provided by the creditor to that
person. 15 U.S.C. 1681m(e)(4)(B).
---------------------------------------------------------------------------
In addition to limiting the scope of coverage for ``creditors'' by
creating these specified categories, the Clarification Act empowers the
Commission, banking agencies, CFTC, and SEC \14\ to determine through a
future rulemaking whether to include any other type of creditor that
offers or maintains accounts that are subject to a reasonably
foreseeable risk of identity theft.\15\ At this time, the Commission
does not intend to use its discretionary rulemaking to extend coverage
of the Red Flags Rule to additional creditors.
---------------------------------------------------------------------------
\14\ The Dodd Frank Wall Street Reform and Consumer Protection
Act added the CFTC and SEC to the list of agencies with rulemaking
and enforcement authority for Red Flags. Pub. L. 111-203, 124 Stat.
1376 (2010).
\15\ 15 U.S.C. 1681m(e)(4)(C).
---------------------------------------------------------------------------
III. The Amended Definition of ``Creditor''
Pursuant to the Clarification Act, the definition of ``creditor''
is amended to ensure that it is consistent with the amended text of the
FCRA. Accordingly, the FTC is amending its regulations applicable to
the entities subject to its jurisdiction to clarify that the definition
of ``creditor'' set forth in the interim final rule has the same
meaning as in 15 U.S.C. 1681m(e)(4).\16\
---------------------------------------------------------------------------
\16\ The FTC has conferred with the banking agencies, CFTC, and
SEC, which do not object to the Commission's issuance of this
interim final rule to amend the Red Flags Rule to conform it to the
Clarification Act. The banking agencies each plan to make conforming
changes to their respective regulations separately in the future.
The CFTC and SEC have issued a proposal setting out their
regulations and guidance under section 615 of FCRA and have included
in that proposal the definition of ``creditor'' as set forth in the
Clarification Act. See 77 FR 13450 (March 6, 2012).
---------------------------------------------------------------------------
A. Regularly and in the Ordinary Course of Business
By referencing the statutory definition of creditor, the interim
final rule limits the definition of ``creditor'' to those ECOA
creditors that ``regularly and in the ordinary course of business''
engage in the specific conduct set forth in the Clarification Act.\17\
``Regularly and in the ordinary course of business'' excludes isolated
conduct.
---------------------------------------------------------------------------
\17\ The question of whether an entity is a ``creditor'' within
the meaning of the Red Flags Rule is only the first step of the
inquiry in determining whether that entity must comply with the
Rule. The second step is to determine whether the creditor has
covered accounts, which means either: (1) Accounts offered primarily
for personal, family, or household purposes that involve or are
designed to permit multiple payments or transactions (e.g., credit
card accounts, mortgage loans, automobile loans, margin accounts,
cell phone accounts, utility accounts, checking or savings
accounts); or (2) any other account a creditor offers or maintains
for which there is a reasonably foreseeable risk to customers or to
the safety and soundness of the creditor from identity theft,
including financial, operational, compliance, reputation, or
litigation risks. 72 FR at 63719, 63721.
---------------------------------------------------------------------------
B. Obtains or Uses Consumer Reports
A ``creditor'' will be covered by the interim final rule if it
regularly and in the ordinary course of its business obtains or uses
consumer reports, directly or indirectly, in connection with a credit
transaction. This includes any use of a consumer report in connection
with a credit transaction, even if the report is not directly obtained
by the creditor and even if the creditor uses a service provider to
make the credit determination. For this
[[Page 72714]]
reason, a creditor that engages a third-party servicer to obtain
consumer report information on its behalf, or to evaluate a consumer's
creditworthiness based upon the consumer's report, is a ``creditor''
under this prong for purposes of the interim final rule.
The Commission notes that for this prong to apply, the creditor
must use or obtain a consumer report ``in connection with a credit
transaction.'' Accordingly, the use of consumer reports for purposes
other than credit B such as employment B will not trigger coverage
under the interim final rule's definition of ``creditor.''
C. Furnishing Information to Credit Reporting Agencies
A creditor will be covered by the interim final rule if it
regularly and in the ordinary course of business furnishes information
to a consumer reporting agency, as described in section 623 of the
FCRA, in connection with a credit transaction.
D. Advancing Funds
Further, a creditor will be covered by the interim final rule if it
regularly and in the ordinary course of business advances funds to a
person, or on behalf of a person, where that person is obligated to
repay the funds or the funds are repayable from pledged specific
property by or on behalf of the person.\18\ This prong covers those
lenders, such as payday lenders and automobile title lenders, that may
not typically obtain, use, or furnish consumer reports in the ordinary
course of business, but lend money to or on behalf of consumers and
thus may be attractive targets for identity thieves. Consistent with
the statutory language, the term ``creditor'' includes not only those
creditors that lend money directly to a consumer, but also those
creditors that advance funds to a third party ``on behalf of a
person.'' Thus, for example, a finance company that provides funds to a
furniture store related to a person's purchase of furniture would be
covered under this prong because it is advancing funds ``on behalf of a
person.''
---------------------------------------------------------------------------
\18\ By incorporating the statutory language ``advances funds,''
the interim final rule does not cover merely deferring payment of
debt or deferring payment for the purchase of property or services.
---------------------------------------------------------------------------
At the same time, the interim final rule provides that the term
``advancing funds'' does not include a creditor that advances funds
``on behalf of a person for expenses incidental to a service provided
by the creditor to that person.'' This limitation makes clear that
advancing funds does not include payment in advance for fees,
materials, or services that are incidental to the creditor's ability to
provide another service that a person initiated or requested.
Accordingly, a lawyer, for example, who advances funds on behalf of a
client to pay expert witness fees or other expenses that are incidental
to a request by a client for the provision of legal services in the
course of litigation will not be deemed to be ``advancing funds.''
Thus, unlike a commercial lender making a loan, a business will not be
deemed a creditor merely by advancing funds and deferring payment for
fees incurred in the course of providing services to a client or
customer.
E. Discretionary Rulemaking Authority
Finally, the Clarification Act provides that the definition of
``creditor'' includes any other type of creditor that an agency with
jurisdiction determines, through a rulemaking, offers or maintains
accounts that are subject to a reasonably foreseeable risk of identity
theft. At this time, the Commission is not initiating discretionary
rulemaking to extend coverage of the Red Flags Rule to additional
creditors.
IV. Good Cause for Interim Final Rule
The Commission finds good cause for adopting the interim final rule
without advance public notice and opportunity for public comment.
Advance public notice and comment are not required ``when the agency
for good cause finds (and incorporates the finding and a brief
statement of reasons therefore in the rules issued) that notice and
public procedure thereon are impracticable, unnecessary, or contrary to
the public interest.'' \19\
---------------------------------------------------------------------------
\19\ 5 U.S.C. 553(b)(3)(B).
---------------------------------------------------------------------------
As discussed above, the Clarification Act amends the definition of
``creditor'' for purposes of the Red Flags Rule. This amendment
necessitates a technical revision of the Red Flags Rule to ensure that
the regulation is consistent with the text of the amended FCRA.
The Commission finds that prior public comment on the Rule is
unnecessary because the Commission has merely codified the amended
statutory definition of ``creditor.'' Delay in adoption of the rule
revision to allow for prior public comment would prolong uncertainty
about the applicability of the Red Flags Rule requirements to the class
of ``creditors,'' as defined in the amended FCRA. As a result, adoption
of this amendment serves the public interest by providing clarity to
the public regarding the entities that are subject to the Rule and
furthering the effectiveness of the Commission's ongoing efforts to
prevent identity theft and fraud through the enforcement of the Rule.
Accordingly, the Commission finds that there is good cause for
adopting this interim final rule as effective on February 11, 2013,
without prior public comment. Nonetheless, in order to promote good and
open government, the Commission exercises its discretion to invite
public comment on the interim final rule. Based on comments received,
the Commission may adjust the interim final rule as necessary.
V. Request for Comments
You can file a comment online or on paper. For the Commission to
consider your comment, we must receive it on or before February 11,
2013. Write ``Red Flags Interim Final Rule,'' on your comment. Your
comment--including your name and your state--will be placed on the
public record of this proceeding, including, to the extent practicable,
on the public Commission Web site, at http://www/ftc/gov/os/
publiccomments.shtm. As a matter of discretion, the Commission tries to
remove individuals' home contact information from comments before
placing them on the Commission Web site.
Because your comment will be made public, you are solely
responsible for making sure that your comment doesn't include any
sensitive personal information, such as anyone's Social Security
number, date of birth, driver's license number or other state
identification number or foreign country equivalent, passport number,
financial account number, or credit or debit card number. You are also
solely responsible for making sure that your comment doesn't include
any sensitive health information, such as medical records or other
individually identifiable health information. In addition, don't
include any `[t]rade secret or any commercial or financial information
which is obtained from any person and which is privileged or
confidential,'' as provided in Section 6(f) of the FTC Act, 15 U.S.C.
46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2). In particular, don't
include competitively sensitive information such as costs, sales
statistics, inventories, formulas, patterns, devices, manufacturing
processes, or customer names.
If you want the Commission to give your comment confidential
treatment, you must file it in paper form, with a request for
confidential treatment, and you have to follow the procedure explained
in FTC Rule 4.9(c), 16 CFR
[[Page 72715]]
4.9(c).\20\ Your comment will be kept confidential only if the FTC
General Counsel, in his or her sole discretion, grants your request in
accordance with the law and the public interest.
---------------------------------------------------------------------------
\20\ In particular, the written request for confidential
treatment that accompanies the comment must include the factual and
legal basis for the request, and must identify the specific portions
of the comment to be withheld from the public record. See FTC Rule
4.9(c), 16 CFR 4.9(c).
---------------------------------------------------------------------------
Postal mail addressed to the Commission is subject to delay due to
heightened security screening. As a result, we encourage you to submit
your comments online. To make sure that the Commission considers your
online comment, you must file it at https://ftcpublic.commentworks.com/ftc/redflagsinterimrule, by following the instruction on the web-based
form. If this Notice appears at http://www.regulations.gov/serach/Regs/home.html#home, you may also file a comment through that Web site.
If you file your comment on paper, write ``Red Flags Interim Final
Rule'' on your comment and on the envelope, and mail or deliver it to
the following address: Federal Trade Commission, Office of the
Secretary, Room H-113 (Annex M), 600 Pennsylvania Avenue NW.,
Washington, DC 20580. If possible, submit your paper comment to the
Commission by courier or overnight service.
Visit the Commission Web site at http://www.ftc.gov to read this
Interim Final Rule and the news release describing it. The FTC Act and
other laws that the Commission administers permit the collection of
public comments to consider and use in this proceeding as appropriate.
The Commission will consider all timely and responsive public comments
that it receives on or before February 11, 2013. You can find more
information, including routine uses permitted by the Privacy Act, in
the Commission's privacy policy, at http://www.ftc.gov/ftc/privacy.htm.
VI. Communications by Outside Parties to the Commissioners or Their
Advisors
Written communications and summaries of transcripts of oral
communications respecting the merits of this proceeding from any
outside party to any Commissioner will be placed on the public
record.\21\
---------------------------------------------------------------------------
\21\ See 16 CFR 1.26(b)(5).
---------------------------------------------------------------------------
VII. Regulatory Analysis
A. Paperwork Reduction Act
The interim final rule does not include any new information
collection requirements under the provisions of the Paperwork Reduction
Act of 1995 (PRA).\22\ Nonetheless, the Commission anticipates that the
narrowed definition of the term ``creditor'' will result in a decrease
in the number of creditors covered by the Red Flags Rule. Commission
staff has proposed revised estimates of hours and costs ``burden''
under the PRA in connection with the FTC's pursuit of renewed OMB
clearance for the Red Flags Rule (under OMB Control No 3084-0137),
which currently runs through November 30, 2012. These estimates, which
factor in the anticipated effects of the amended Rule, appear
separately in the Federal Register for public comment.\23\
---------------------------------------------------------------------------
\22\ 44 U.S.C. 3501-3521. Under the PRA, federal agencies must
obtain approval from OMB for each collection of information they
conduct or sponsor. ``Collection of information'' means agency
requests or requirements that members of the public submit reports,
keep records, or provide information to a third party. 44 U.S.C.
3502(3).
\23\ See 77 FR 58994 (Sept. 25, 2012) (comment period ending
Oct. 25, 2012).
---------------------------------------------------------------------------
B. Regulatory Flexibility Act
The Regulatory Flexibility Act (RFA), 5 U.S.C. 601-612, requires
that the Commission provide an Initial Regulatory Flexibility Analysis
(IRFA) with a proposed rule and a Final Regulatory Flexibility Analysis
(FRFA), if any, with a final rule. As noted above, the Commission finds
that good cause exists for adopting this interim final rule without
advance public notice or an opportunity for public comment. Because
notice and comment is not statutorily required, the requirement to
publish an analysis under the Regulatory Flexibility Act does not apply
in this proceeding.\24\
---------------------------------------------------------------------------
\24\ 5 U.S.C. 603, 604.
---------------------------------------------------------------------------
List of Subjects in 16 CFR Part 681
Consumer reports, Consumer report users, Consumer reporting
agencies, Credit, Creditors, Fair credit, Information furnishers,
Identity theft, Trade practices.
For the reasons discussed in the preamble, the Commission amends
part 681 of title 16 of the Code of Federal Regulations as follows:
PART 681--IDENTITY THEFT RULES
0
1. Revise the authority citation for part 681 to read as follows:
Authority: 15 U.S.C. 1681m(e); 15 U.S.C. 1681m(e)(4); 15 U.S.C.
1681c(h).
0
2. Revise 681.1(b)(5) to read as follows:
681.1 Duties regarding the detection, prevention, and mitigation of
identity theft.
* * * * *
(b) * * *
(5) Creditor has the same meaning as in 15 U.S.C. 1681m(e)(4).
* * * * *
By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 2012-29430 Filed 12-5-12; 8:45 am]
BILLING CODE 6750-01-P