An ID check at account opening is an important step in preventing identity theft, but it does not fully satisfy the Red Flags Rule. Banks and lenders also need to watch for signs of identity theft after an account has been opened, since suspicious activity can appear at any point in the customer relationship.
The challenge is that the rule does not provide a single checklist that every business can follow. Instead, each covered business must identify the warning signs relevant to its accounts and include them in a written identity theft prevention program. This means the checks a business needs will depend on the types of accounts it offers and the risks associated with them.
So, how can you determine whether the Red Flags Rule applies to your business, and which warning signs should your application forms help you identify?
The Federal Trade Commission (FTC) treats coverage as a two-part test, based on what you do, not your industry. The Red Flags Rule requires financial institutions and creditors with covered accounts to keep a written identity theft prevention program. The program must be designed to detect, prevent and limit identity theft, at account opening and on existing accounts.
This is a US rule under the Fair Credit Reporting Act (15 U.S.C. 1681m(e)). The FTC version, often called the FTC Red Flags Rule, is in 16 CFR Part 681.
A financial institution is a bank, a savings association or a credit union. It is also any other business that holds a consumer’s transaction account, such as a checking account (15 U.S.C. 1681a(t)).
The Red Flag Program Clarification Act of 2010 narrowed what counts as a creditor. A business that extends or arranges credit counts only if it does one of three things. It has to do so regularly and in the ordinary course of business.
The three are getting or using consumer reports for credit, reporting credit information to consumer reporting agencies, and lending money that must be paid back (15 U.S.C. 1681m(e)(4)). A law practice that pays a client’s court fees as part of its service is not lending.
The FTC’s how-to guide adds that letting customers pay later, or taking card payments, does not make you a creditor on its own.
Covered accounts come in two kinds. The first is a personal, family or household account that allows several payments or transactions. Examples are a mortgage, a car loan, a utility account, and a checking or savings account.
These are always covered. The second kind is any other account with a reasonably foreseeable risk of identity theft. A commercial loan to a small business can fall here, for example when it can be accessed online or by phone.
From time to time, you must check whether you have covered accounts. The check looks at how accounts are opened and accessed, and at any past identity theft (16 CFR 681.1(c)).
Red Flags Rule compliance is built around the written program. Its policies and procedures must do four things (16 CFR 681.1(d)(2)):
Your board, or a board committee, must approve the first written version. A business with no board uses a designated senior manager instead.
The board, a committee or a senior manager must also help run it. Staff must be trained as needed. Service providers must be overseen too, such as an online platform customers use to open accounts.
The rule’s guidelines add that staff should report on compliance at least once a year. The rule sets no record-keeping period. Still, a 2009 FAQ from six federal agencies says you must be able to show you comply.
The rule’s guidelines list 26 numbered examples in five categories. Only the Securities and Exchange Commission’s version, Regulation S-ID, lists 25. It leaves out the example about new revolving credit accounts.
None of them is required. You pick the ones that fit your accounts, and you can add your own.
These are identity theft signs, not the money laundering red flags in a know your customer (KYC) review. A client who will not explain where their money comes from is one of those.
These warnings usually come with the credit report or other consumer report you pull when someone applies. The consumer reporting agency, such as a credit bureau, may add a fraud alert or an active duty alert.
It may also send notice of a credit freeze, or say the address you gave differs substantially from its records.
The report itself may show a sudden jump in inquiries or new credit accounts, or a big change in credit use. An account closed for cause is another sign.
An ID may look altered or forged, or its photo or description may not match the person presenting it. Other details on it may not match what the applicant told you, or your own records.
The application can look altered, or as if it was torn up and put back together. The 2009 FAQ adds that spotting an altered ID can take a manual review by employees.
With Clustdoc identity verification, your team can mark an ID as verified or flag an issue before the customer moves forward.
This is the largest category, covering nine warning signs related to inconsistent, missing, or suspicious personal information. Some involve details that do not match external records, such as an address that does not match any address in the consumer report. Others involve inconsistencies within the application itself, such as a Social Security number (SSN) that does not align with the applicant’s date of birth.
Other warning signs include an SSN that was never issued or appears in the Social Security Administration’s Death Master File. An address linked to a mail drop, prison, or known fraudulent application may also require closer review, although these details do not automatically indicate fraud.
Missing information can raise concerns as well, particularly when an applicant fails to provide required details after being asked. Another warning sign is an applicant who cannot answer identity verification questions that someone with genuine knowledge of their personal history should reasonably know.
These seven examples come after the account opens, so they belong to account servicing, not the application form. A request for a new card or an extra authorized user may arrive soon after a change of address.
A new revolving credit account may be used mostly for cash advances, or be paid once or not at all.
An existing account may break its usual pattern, or an inactive one may suddenly be used. Mail may keep coming back undeliverable while the account stays in use. You may also learn of missing statements or charges the customer did not authorize.
The last category has one example. A customer, a victim, the police or anyone else reports a fraudulent account you opened for an identity thief. The guidelines list possible responses, such as closing the account, not trying to collect on it and notifying law enforcement.
If you already run a customer identification program (CIP), you have done part of the work. A CIP is part of a bank’s anti-money laundering program. It sets the details a bank collects and verifies, such as name, date of birth, address and an ID number.
The Red Flags Rule comes from the Fair Credit Reporting Act and covers identity theft at opening and afterwards. Its guidelines say you can use your CIP procedures to verify the people who open covered accounts.
The law also says the guidelines must not conflict with those procedures (15 U.S.C. 1681m(e)(3)). Still, a CIP leaves two gaps.
CIP rules cover banks (savings associations and credit unions included), broker-dealers, mutual funds, and futures commission merchants and introducing brokers. No CIP rule covers payday lenders, but the FTC says the Red Flags Rule covers them.
A CIP also covers only identity for new accounts. Your program still needs steps for existing ones, such as checking a change of address request.
Seven federal agencies have their own, nearly identical version. Use the one from the agency that oversees your business.
|
Agency |
Who it covers |
Rule |
|---|---|---|
|
Federal Trade Commission (FTC) |
Most businesses not listed below, such as payday lenders and state-chartered credit unions |
16 CFR 681 |
|
Office of the Comptroller of the Currency (OCC) |
National banks, federal savings associations and federal branches of foreign banks |
12 CFR 41, Subpart J |
|
Federal Reserve Board |
State banks that are Federal Reserve members, and some foreign bank offices |
12 CFR 222, Subpart J |
|
Federal Deposit Insurance Corporation (FDIC) |
Other insured state banks and insured state savings associations |
12 CFR 334, Subpart J |
|
National Credit Union Administration (NCUA) |
Federal credit unions |
12 CFR 717, Subpart J |
|
Securities and Exchange Commission (SEC) |
Registered broker-dealers, investment companies and investment advisers |
17 CFR 248, Subpart C (Regulation S-ID) |
|
Commodity Futures Trading Commission (CFTC) |
Futures commission merchants, swap dealers and similar firms |
17 CFR 162, Subpart C |
Most examples in the first three categories can come up during an application. Plan for them in the form and the review, starting with these points:
In our approval workflow, a checkpoint can hold an application until the essential information is provided. Our onboarding form also keeps a version history of each submission, so a reviewer can see when a detail changed.
Book a demo call and tell us which warning signs your program lists for new applications. We will show how a Clustdoc onboarding form can collect the details your reviewers check.
This US rule requires financial institutions and creditors with covered accounts to keep a written identity theft prevention program. The program must be designed to detect, prevent and limit identity theft at account opening and on existing accounts. The Federal Trade Commission's version is in 16 CFR Part 681.
The Federal Trade Commission enforces it with several other agencies. For banks, these are the Office of the Comptroller of the Currency, the Federal Reserve and the Federal Deposit Insurance Corporation. The others are the National Credit Union Administration, the Securities and Exchange Commission and the Commodity Futures Trading Commission.
It can, but not automatically. A business account is covered only when it carries a reasonably foreseeable risk of identity theft. The Federal Trade Commission names small business and sole proprietorship accounts as examples.
Regulation S-ID is the Securities and Exchange Commission's version, for registered broker-dealers, investment companies and investment advisers. It asks for the same four-part program. But it lists 25 examples instead of 26, because it drops the one about new revolving credit accounts.
Still stitching emails, files, and approvals together?
Clustdoc gives teams one place to run client-facing work, boost customer engagement and increase compliance.
Claire writes about customer onboarding, digital processes, and the day-to-day challenges faced by operations teams. At Clustdoc, she focuses on practical insights: how organizations collect information, guide customers through complex steps, and improve service delivery with automation.
