by Rob Douglas

The Federal Trade Commission announced today that they are suspending the implementation of the Identity Theft Red Flags Rule for businesses and organizations they have regulatory power over.  Originally, the rule was to be enforced as of November 1, 2008.  The FTC granted a six-month extension, making the implementation date May 1, 2009.

FTC Red Flags Rule

The FTC provided the following reason for the delay: “Commission staff learned that some industries and entities within the FTC’s jurisdiction were uncertain about their coverage under the Rule. These entities indicated that they were not aware that they were engaged in activities that would cause them to fall under the FACT Act’s definition of creditor or financial institution. Many entities also noted that, because they generally are not required to comply with FTC rules in other contexts, they had not followed or even been aware of the rulemaking, and therefore learned of the Rule’s requirements too late to be able to come into compliance by November 1, 2008. The Commission’s delay of enforcement will enable these entities sufficient time to establish and implement appropriate identity theft prevention programs, in compliance with the Rule.”

However, it should be noted the FTC’s decision does not extend to all entities covered by the Red Flag Rules.  According to the Commission, “Today’s announcement and the release of an Enforcement Policy Statement do not affect other federal agencies’ enforcement of the original November 1, 2008 deadline for institutions subject to their oversight to be in compliance.”

In short, financial institutions covered by regulatory agencies other than the FTC will still have to be in compliance with the rule by November 1st.

The full press release from the FTC is available here → FTC Grants Six-Month Delay of Enforcement of ‘Red Flags’ Rule