FTC Relaxes Enforcement Date on FACTA Red Flag rules. More time to implement CCM-T for Compliance

FTC Grants Three-Month Delay of Enforcement of ‘Red Flags’ Rule Requiring Creditors and Financial Institutions to Adopt Identity Theft Prevention Programs (source: FTC.gov - April 30, 2009)

The Federal Trade Commission will delay enforcement of the new “Red Flags Rule” until August 1, 2009, to give creditors and financial institutions more time to develop and implement written identity theft prevention programs. For entities that have a low risk of identity theft, such as businesses that know their customers personally, the Commission will soon release a template to help them comply with the law. This announcement does not affect other federal agencies’ enforcement of the original November 1, 2008 compliance deadline for institutions subject to their oversight.

As many of you know, Visual Risk IQ was a sponsor at MISTI's SuperStrategies Conference in mid-April, and the conference provided us the opportunity to network with Internal Audit and GRC professionals from all over the US, including a mix of consulting firms and medium and large businesses. The importance of FACTA compliance at the Conference was clearly mixed, with some firms such those in Utilities, Financial Services, and Healthcare having large projects or program offices established to address compliance, with other firms in the same industry being wholly unfamiliar with the regulation.

For more information on FACTA and the red flag compliance rules, please see the following resources:

FTC's web site on Red Flag Rules
FTC's Article Summary

What is happening at your organization? How is this relaxed enforcement date affecting your organization? Why?