Friday,
November 9, 2007
Part IV
Department of the Treasury
Office of the Comptroller of the
Currency
12 CFR Part 41
Federal Reserve System
12 CFR Part 222
Federal Deposit Insurance
Corporation
12 CFR Parts 334 and 364
Department of the Treasury
Office of Thrift Supervision
12 CFR Part 571
National Credit Union
Administration
12 CFR Part 717
Federal Trade Commission
16 CFR Part 681
Identity Theft Red Flags and Address
Discrepancies Under the Fair and
Accurate Credit Transactions Act of 2003;
Final Rule
VerDate Aug<31>2005 20:05 Nov 08, 2007 Jkt 214001 PO 00000 Frm 00001 Fmt 4737 Sfmt 4737 E:\FR\FM\09NOR4.SGM 09NOR4
jlentini on PROD1PC65 with RULES4
November 9, 2007
Part IV
Department of the Treasury
Office of the Comptroller of the
Currency
12 CFR Part 41
Federal Reserve System
12 CFR Part 222
Federal Deposit Insurance
Corporation
12 CFR Parts 334 and 364
Department of the Treasury
Office of Thrift Supervision
12 CFR Part 571
National Credit Union
Administration
12 CFR Part 717
Federal Trade Commission
16 CFR Part 681
Identity Theft Red Flags and Address
Discrepancies Under the Fair and
Accurate Credit Transactions Act of 2003;
Final Rule
VerDate Aug<31>2005 20:05 Nov 08, 2007 Jkt 214001 PO 00000 Frm 00001 Fmt 4737 Sfmt 4737 E:\FR\FM\09NOR4.SGM 09NOR4
jlentini on PROD1PC65 with RULES4
63718 Federal Register / Vol. 72, No. 217 / Friday, November 9, 2007 / Rules and Regulations
1 Pub. L. 108–159.
2 Section 111 of the FACT Act defines ‘‘identity
theft’’ as ‘‘a fraud committed using the identifying
information of another person, subject to such
further definition as the [Federal Trade]
Commission may prescribe, by regulation.’’ 15
U.S.C. 1681a(q)(3).
DEPARTMENT OF THE TREASURY
Office of the Comptroller of the
Currency
12 CFR Part 41
[Docket ID OCC–2007–0017]
RIN 1557–AC87
FEDERAL RESERVE SYSTEM
12 CFR Part 222
[Docket No. R–1255]
FEDERAL DEPOSIT INSURANCE
CORPORATION
12 CFR Parts 334 and 364
RIN 3064–AD00
DEPARTMENT OF THE TREASURY
Office of Thrift Supervision
12 CFR Part 571
[Docket No. OTS–2007–0019]
RIN 1550–AC04
NATIONAL CREDIT UNION
ADMINISTRATION
12 CFR Part 717
FEDERAL TRADE COMMISSION
16 CFR Part 681
RIN 3084–AA94
Identity Theft Red Flags and Address
Discrepancies Under the Fair and
Accurate Credit Transactions Act of
2003
AGENCIES: Office of the Comptroller of
the Currency, Treasury (OCC); Board of
Governors of the Federal Reserve
System (Board); Federal Deposit
Insurance Corporation (FDIC); Office of
Thrift Supervision, Treasury (OTS);
National Credit Union Administration
(NCUA); and Federal Trade Commission
(FTC or Commission).
ACTION: Joint final rules and guidelines.
SUMMARY: The OCC, Board, FDIC, OTS,
NCUA and FTC (the Agencies) are
jointly issuing final rules and guidelines
implementing section 114 of the Fair
and Accurate Credit Transactions Act of
2003 (FACT Act) and final rules
implementing section 315 of the FACT
Act. The rules implementing section
114 require each financial institution or
creditor to develop and implement a
written Identity Theft Prevention
Program (Program) to detect, prevent,
and mitigate identity theft in connection
with the opening of certain accounts or
certain existing accounts. In addition,
the Agencies are issuing guidelines to
assist financial institutions and
creditors in the formulation and
maintenance of a Program that satisfies
the requirements of the rules. The rules
implementing section 114 also require
credit and debit card issuers to assess
the validity of notifications of changes
of address under certain circumstances.
Additionally, the Agencies are issuing
joint rules under section 315 that
provide guidance regarding reasonable
policies and procedures that a user of
consumer reports must employ when a
consumer reporting agency sends the
user a notice of address discrepancy.
DATES: The joint final rules and
guidelines are effective January 1, 2008.
The mandatory compliance date for this
rule is November 1, 2008.
FOR FURTHER INFORMATION CONTACT:
OCC: Amy Friend, Assistant Chief
Counsel, (202) 874–5200; Deborah Katz,
Senior Counsel, or Andra Shuster,
Special Counsel, Legislative and
Regulatory Activities Division, (202)
874–5090; Paul Utterback, Compliance
Specialist, Compliance Department,
(202) 874–5461; or Aida Plaza Carter,
Director, Bank Information Technology,
(202) 874–4740, Office of the
Comptroller of the Currency, 250 E
Street, SW., Washington, DC 20219.
Board: David A. Stein or Ky Tran-
Trong, Counsels, or Amy Burke,
Attorney, Division of Consumer and
Community Affairs, (202) 452–3667;
Kara L. Handzlik, Attorney, Legal
Division, (202) 452–3852; or John
Gibbons, Supervisory Financial Analyst,
Division of Banking Supervision and
Regulation, (202) 452–6409, Board of
Governors of the Federal Reserve
System, 20th and C Streets, NW.,
Washington, DC 20551.
FDIC: Jeffrey M. Kopchik, Senior
Policy Analyst, (202) 898–3872, or
David P. Lafleur, Policy Analyst, (202)
898–6569, Division of Supervision and
Consumer Protection; Richard M.
Schwartz, Counsel, (202) 898–7424, or
Richard B. Foley, Counsel, (202) 898–
3784, Legal Division, Federal Deposit
Insurance Corporation, 550 17th Street,
NW., Washington, DC 20429.
OTS: Ekita Mitchell, Consumer
Regulations Analyst, Compliance and
Consumer Protection, (202) 906–6451;
Kathleen M. McNulty, Technology
Program Manager, Information
Technology Risk Management, (202)
906–6322; or Richard Bennett, Senior
Compliance Counsel, Regulations and
Legislation Division, (202) 906–7409,
Office of Thrift Supervision, 1700 G
Street, NW., Washington, DC 20552.
NCUA: Regina M. Metz, Staff
Attorney, Office of General Counsel,
(703) 518–6540, National Credit Union
Administration, 1775 Duke Street,
Alexandria, VA 22314–3428.
FTC: Naomi B. Lefkovitz, Attorney, or
Pavneet Singh, Attorney, Division of
Privacy and Identity Protection, Bureau
of Consumer Protection, (202) 326–
2252, Federal Trade Commission, 600
Pennsylvania Avenue, NW., Washington
DC 20580.
SUPPLEMENTARY INFORMATION:
I. Introduction
The President signed the FACT Act
into law on December 4, 2003.1 The
FACT Act added several new provisions
to the Fair Credit Reporting Act of 1970
(FCRA), 15 U.S.C. 1681 et seq. Section
114 of the FACT Act, 15 U.S.C.
1681m(e), amends section 615 of the
FCRA, and directs the Agencies to issue
joint regulations and guidelines
regarding the detection, prevention, and
mitigation of identity theft, including
special regulations requiring debit and
credit card issuers to validate
notifications of changes of address
under certain circumstances.2 Section
315 of the FACT Act, 15 U.S.C.
1681c(h), adds a new section 605(h)(2)
to the FCRA requiring the Agencies to
issue joint regulations that provide
guidance regarding reasonable policies
and procedures that a user of a
consumer report should employ when
the user receives a notice of address
discrepancy.
On July 18, 2006, the Agencies
published a joint notice of proposed
rulemaking (NPRM) in the Federal
Register (71 FR 40786) proposing rules
and guidelines to implement section
114 and proposing rules to implement
section 315 of the FACT Act. The public
comment period closed on September
18, 2006. The Agencies collectively
received a total of 129 comments in
response to the NPRM, although many
commenters sent copies of the same
letter to each of the Agencies. The
comments included 63 from financial
institutions, 12 from financial
institution holding companies, 23 from
financial institution trade associations,
12 from individuals, nine from other
trade associations, five from other
business entities, three from consumer
VerDate Aug<31>2005 20:05 Nov 08, 2007 Jkt 214001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\09NOR4.SGM 09NOR4
jlentini on PROD1PC65 with RULES4
1 Pub. L. 108–159.
2 Section 111 of the FACT Act defines ‘‘identity
theft’’ as ‘‘a fraud committed using the identifying
information of another person, subject to such
further definition as the [Federal Trade]
Commission may prescribe, by regulation.’’ 15
U.S.C. 1681a(q)(3).
DEPARTMENT OF THE TREASURY
Office of the Comptroller of the
Currency
12 CFR Part 41
[Docket ID OCC–2007–0017]
RIN 1557–AC87
FEDERAL RESERVE SYSTEM
12 CFR Part 222
[Docket No. R–1255]
FEDERAL DEPOSIT INSURANCE
CORPORATION
12 CFR Parts 334 and 364
RIN 3064–AD00
DEPARTMENT OF THE TREASURY
Office of Thrift Supervision
12 CFR Part 571
[Docket No. OTS–2007–0019]
RIN 1550–AC04
NATIONAL CREDIT UNION
ADMINISTRATION
12 CFR Part 717
FEDERAL TRADE COMMISSION
16 CFR Part 681
RIN 3084–AA94
Identity Theft Red Flags and Address
Discrepancies Under the Fair and
Accurate Credit Transactions Act of
2003
AGENCIES: Office of the Comptroller of
the Currency, Treasury (OCC); Board of
Governors of the Federal Reserve
System (Board); Federal Deposit
Insurance Corporation (FDIC); Office of
Thrift Supervision, Treasury (OTS);
National Credit Union Administration
(NCUA); and Federal Trade Commission
(FTC or Commission).
ACTION: Joint final rules and guidelines.
SUMMARY: The OCC, Board, FDIC, OTS,
NCUA and FTC (the Agencies) are
jointly issuing final rules and guidelines
implementing section 114 of the Fair
and Accurate Credit Transactions Act of
2003 (FACT Act) and final rules
implementing section 315 of the FACT
Act. The rules implementing section
114 require each financial institution or
creditor to develop and implement a
written Identity Theft Prevention
Program (Program) to detect, prevent,
and mitigate identity theft in connection
with the opening of certain accounts or
certain existing accounts. In addition,
the Agencies are issuing guidelines to
assist financial institutions and
creditors in the formulation and
maintenance of a Program that satisfies
the requirements of the rules. The rules
implementing section 114 also require
credit and debit card issuers to assess
the validity of notifications of changes
of address under certain circumstances.
Additionally, the Agencies are issuing
joint rules under section 315 that
provide guidance regarding reasonable
policies and procedures that a user of
consumer reports must employ when a
consumer reporting agency sends the
user a notice of address discrepancy.
DATES: The joint final rules and
guidelines are effective January 1, 2008.
The mandatory compliance date for this
rule is November 1, 2008.
FOR FURTHER INFORMATION CONTACT:
OCC: Amy Friend, Assistant Chief
Counsel, (202) 874–5200; Deborah Katz,
Senior Counsel, or Andra Shuster,
Special Counsel, Legislative and
Regulatory Activities Division, (202)
874–5090; Paul Utterback, Compliance
Specialist, Compliance Department,
(202) 874–5461; or Aida Plaza Carter,
Director, Bank Information Technology,
(202) 874–4740, Office of the
Comptroller of the Currency, 250 E
Street, SW., Washington, DC 20219.
Board: David A. Stein or Ky Tran-
Trong, Counsels, or Amy Burke,
Attorney, Division of Consumer and
Community Affairs, (202) 452–3667;
Kara L. Handzlik, Attorney, Legal
Division, (202) 452–3852; or John
Gibbons, Supervisory Financial Analyst,
Division of Banking Supervision and
Regulation, (202) 452–6409, Board of
Governors of the Federal Reserve
System, 20th and C Streets, NW.,
Washington, DC 20551.
FDIC: Jeffrey M. Kopchik, Senior
Policy Analyst, (202) 898–3872, or
David P. Lafleur, Policy Analyst, (202)
898–6569, Division of Supervision and
Consumer Protection; Richard M.
Schwartz, Counsel, (202) 898–7424, or
Richard B. Foley, Counsel, (202) 898–
3784, Legal Division, Federal Deposit
Insurance Corporation, 550 17th Street,
NW., Washington, DC 20429.
OTS: Ekita Mitchell, Consumer
Regulations Analyst, Compliance and
Consumer Protection, (202) 906–6451;
Kathleen M. McNulty, Technology
Program Manager, Information
Technology Risk Management, (202)
906–6322; or Richard Bennett, Senior
Compliance Counsel, Regulations and
Legislation Division, (202) 906–7409,
Office of Thrift Supervision, 1700 G
Street, NW., Washington, DC 20552.
NCUA: Regina M. Metz, Staff
Attorney, Office of General Counsel,
(703) 518–6540, National Credit Union
Administration, 1775 Duke Street,
Alexandria, VA 22314–3428.
FTC: Naomi B. Lefkovitz, Attorney, or
Pavneet Singh, Attorney, Division of
Privacy and Identity Protection, Bureau
of Consumer Protection, (202) 326–
2252, Federal Trade Commission, 600
Pennsylvania Avenue, NW., Washington
DC 20580.
SUPPLEMENTARY INFORMATION:
I. Introduction
The President signed the FACT Act
into law on December 4, 2003.1 The
FACT Act added several new provisions
to the Fair Credit Reporting Act of 1970
(FCRA), 15 U.S.C. 1681 et seq. Section
114 of the FACT Act, 15 U.S.C.
1681m(e), amends section 615 of the
FCRA, and directs the Agencies to issue
joint regulations and guidelines
regarding the detection, prevention, and
mitigation of identity theft, including
special regulations requiring debit and
credit card issuers to validate
notifications of changes of address
under certain circumstances.2 Section
315 of the FACT Act, 15 U.S.C.
1681c(h), adds a new section 605(h)(2)
to the FCRA requiring the Agencies to
issue joint regulations that provide
guidance regarding reasonable policies
and procedures that a user of a
consumer report should employ when
the user receives a notice of address
discrepancy.
On July 18, 2006, the Agencies
published a joint notice of proposed
rulemaking (NPRM) in the Federal
Register (71 FR 40786) proposing rules
and guidelines to implement section
114 and proposing rules to implement
section 315 of the FACT Act. The public
comment period closed on September
18, 2006. The Agencies collectively
received a total of 129 comments in
response to the NPRM, although many
commenters sent copies of the same
letter to each of the Agencies. The
comments included 63 from financial
institutions, 12 from financial
institution holding companies, 23 from
financial institution trade associations,
12 from individuals, nine from other
trade associations, five from other
business entities, three from consumer
VerDate Aug<31>2005 20:05 Nov 08, 2007 Jkt 214001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\09NOR4.SGM 09NOR4
jlentini on PROD1PC65 with RULES4