(a) Scope. This section applies to financial institutions and creditors
that are member banks of the Federal Reserve System (other than national
banks) and their respective operating subsidiaries, branches and agencies
of foreign banks (other than federal branches, federal agencies, and
insured state branches of foreign banks), commercial lending companies
owned or controlled by foreign banks, and organizations operating
under section 25 or 25A of the Federal Reserve Act (12 U.S.C. 601 et seq., and 611 et seq.).
(b) Definitions. For purposes of this section
and appendix J, the following definitions apply:
(1) Account means a continuing relationship
established by a person with a financial institution or creditor to
obtain a product or service for personal, family, household, or business
purposes. Account includes—
(i) an extension of credit, such as
the purchase of property or services involving a deferred payment;
and
(ii) a deposit
account.
(2) The term board of directors includes—
(i) in the
case of a branch or agency of a foreign bank, the managing official
in charge of the branch or agency; and
(ii) in the case of any other creditor
that does not have a board of directors, a designated employee at
the level of senior management.
(3) Covered account means—
(i) an
account that a financial institution or creditor offers or maintains,
primarily for personal, family, or household purposes, that involves
or is designed to permit multiple payments or transactions, such as
a credit card account, mortgage loan, automobile loan, margin account,
cell phone account, utility account, checking account, or savings
account; and
(ii)
any other account that the financial institution or creditor offers
or maintains for which there is a reasonably foreseeable risk to customers
or to the safety and soundness of the financial institution or creditor
from identity theft, including financial, operational, compliance,
reputation, or litigation risks.
(4) Credit has the same meaning
as in 15 U.S.C. 1681a(r)(5).
(5) Creditor has the same meaning
as in 15 U.S.C. 1681m(e)(4).
(6) Customer means a person that
has a covered account with a financial institution or creditor.
(7) Financial institution has the same meaning as in 15 U.S.C. 1681a(t).
(8) Identity theft has the same
meaning as in 16 CFR 603.2(a).
(9) Red flag means a pattern, practice,
or specific activity that indicates the possible existence of identity
theft.
(10) Service
provider means a person that provides a service directly to the
financial institution or creditor.
6-3118
(c) Periodic identification of covered accounts. Each financial institution or creditor must periodically determine
whether it offers or maintains covered accounts. As a part of this
determination, a financial institution or creditor must conduct a
risk assessment to determine whether it offers or maintains covered accounts
described in paragraph (b)(3)(ii) of this section, taking into consideration—
(1) the methods it provides
to open its accounts;
(2) the methods it provides to access its accounts; and
(3) its previous experiences
with identity theft.
(d) Establishment of an identity theft prevention
program.
(1) Program requirement. Each financial institution or creditor that offers or maintains
one or more covered accounts must develop and implement a written
identity theft prevention program (program) that is designed to detect,
prevent, and mitigate identity theft in connection with the opening
of a covered account or any existing covered account. The program
must be appropriate to the size and complexity of the financial institution
or creditor and the nature and scope of its activities.
(2) Elements of the program. The program must include reasonable
policies and procedures to—
(i) identify relevant red flags for
the covered accounts that the financial institution or creditor offers
or maintains, and incorporate those red flags into its program;
(ii) detect red flags
that have been incorporated into the program of the financial institution
or creditor;
(iii)
respond appropriately to any red flags that are detected pursuant
to paragraph (d)(2)(ii) of this section to prevent and mitigate identity
theft; and
(iv) ensure
the program (including the red flags determined to be relevant) is
updated periodically, to reflect changes in risks to customers and
to the safety and soundness of the financial institution or creditor
from identity theft.
6-3119
(e) Administration of the program. Each financial
institution or creditor that is required to implement a program must
provide for the continued administration of the program and must—
(1) obtain approval of the initial written
program from either its board of directors or an appropriate committee
of the board of directors;
(2) involve the board of directors, an appropriate committee thereof,
or a designated employee at the level of senior management in the
oversight, development, implementation and administration of the program;
(3) train staff, as necessary,
to effectively implement the program; and
(4) exercise appropriate and effective
oversight of service-provider arrangements.
(f) Guidelines. Each financial
institution or creditor that is required to implement a program must
consider the guidelines in appendix J of this part and include in
its program those guidelines that are appropriate.
