FTC Red Flags Rule: How to Build a Compliant Identity Theft Prevention Programme

The Red Flags Rule requires any financial institution or creditor that offers covered accounts to run a written, board-approved programme that spots the warning signs of identity theft and acts on them, and many lenders, utilities, telecoms providers and fintechs fall inside it without realising. The rule sits at 16 CFR Part 681 for businesses under Federal Trade Commission jurisdiction, with an almost identical version, Regulation S-ID, at 17 CFR Part 248 Subpart C for broker-dealers, funds and investment advisers regulated by the Securities and Exchange Commission. It is about detecting and responding to identity theft in accounts, which is a different job from protecting customer data under the GLBA Safeguards Rule Guide. This guide explains who is covered, how to identify covered accounts, the four required programme elements and the 26 illustrative red flags, the card issuer and address discrepancy rules, enforcement, and how automation and AI agents change the detection picture. It is written for fraud, compliance and identity teams.

Key takeaways

• Coverage depends on conduct, not industry: a business is a creditor if it regularly defers payment or grants credit and, in the ordinary course of business, uses or furnishes consumer reports or advances funds that must be repaid.
• Covered accounts drive everything: consumer accounts that allow multiple payments or transactions are always covered; other accounts are covered where identity theft risk is reasonably foreseeable, and the assessment must be repeated periodically.
• Four elements are mandatory: identify relevant red flags, detect them, respond appropriately, and update the programme as risks change.
• The board signs off: the board of directors or a board committee approves the initial written programme, and the guidelines expect a report to the board or senior management at least annually.
• Penalties are adjusted each year: the FTC's inflation-adjusted civil penalty for Fair Credit Reporting Act section 621(a)(2) is listed as $4,983 per violation in the 2025 adjustment.

Scope: who and what is covered

Financial institutions and creditors

Section 681.1 applies to financial institutions and creditors subject to FTC enforcement under the Fair Credit Reporting Act. The terms come from the FCRA. A financial institution includes banks, savings associations, credit unions and any person that holds a transaction account belonging to a consumer; for the FTC's rule the main group is state-chartered credit unions and non-bank account holders, because banks follow their own regulators' equivalent rules. The FTC's guidance describes a two-step test for creditors.

The Red Flag Program Clarification Act of 2010 narrowed the creditor definition by excluding businesses that advance funds only for expenses incidental to their services. Using credit reports only to screen job applicants does not trigger coverage.

Covered accounts

Section 681.1(b) defines two kinds of covered account. The first is an account offered primarily for personal, family or household purposes that involves or is designed to permit multiple payments or transactions, such as a credit card, mortgage, auto loan, utility, mobile phone, checking or savings account. The second is any other account for which there is a reasonably foreseeable risk of identity theft to customers or to the safety and soundness of the business, including financial, operational, compliance, reputation or litigation risk. Small business accounts, sole proprietorships and single-transaction consumer accounts can fall into the second group, depending on how they are opened and accessed and on actual fraud experience.

Section 681.1(c) requires a periodic determination of whether the business offers or maintains covered accounts, using a risk assessment that considers how accounts are opened, how they are accessed, and previous experience with identity theft. If there are none, no written programme is required, but the FTC recommends reassessing as products change.

Regulation S-ID for SEC-regulated firms

Regulation S-ID, at 17 CFR 248.201 and 248.202, applies the same structure to broker-dealers and other persons registered or required to register under the Securities Exchange Act of 1934, investment companies registered under the Investment Company Act of 1940 (including business development companies and employees' securities companies), and investment advisers registered under the Investment Advisers Act of 1940. It was published at 78 FR 23663 on 17 April 2013. The definitions of covered account, the four programme elements, board approval and the 30-day card issuer rule match the FTC rule, so one programme design can serve both.

Key obligations

The four programme elements (section 681.1(d))

Administration (section 681.1(e))

• Approval: the board of directors or an appropriate board committee approves the initial written programme. Where there is no board, a designated senior management employee fills that role.
• Oversight: the board, a committee or a designated senior manager is involved in oversight, development, implementation and administration.
• Training: staff are trained as necessary to implement the programme effectively.
• Service providers: appropriate and effective oversight of providers that perform activities on covered accounts, such as account opening, billing, customer service or collections, typically by contract requiring them to detect and respond to red flags.
• Annual report: Appendix A guidelines expect a report at least annually to the board, a committee or a senior manager on programme effectiveness, service provider oversight, significant incidents and the response, and recommended material changes.

The 26 illustrative red flags in five categories

The FTC guidance warns that Social Security numbers, birth dates, mothers' maiden names and mailing addresses are unreliable authenticators, and points to multi-factor methods for online access. See the Identity Proofing and KYC Guide and the Account Opening and Application Fraud Guide.

Card issuer change of address duties (section 681.2)

A card issuer that receives a change of address notice and, within a short period afterwards (during at least the first 30 days), a request for an additional or replacement card on the same account, may not issue the card until it has notified the cardholder at the former address or by another previously agreed means and given a reasonable way to report an incorrect change, or has otherwise assessed the change under its programme. Validating the address when the change notice arrives also satisfies the rule. Notices must be clear and conspicuous and sent separately from regular correspondence.

Address discrepancy rule

When a consumer reporting agency sends a notice of a substantial difference between the address a user supplied and the address in its file, the user must have reasonable procedures to form a reasonable belief that the report relates to the consumer, for example by comparing it with its own identity verification records or checking directly with the consumer. Where it then establishes a continuing relationship and regularly furnishes data to that agency, it must furnish an address it has reasonably confirmed as accurate. The FTC's version, 16 CFR 641.1, now applies to motor vehicle dealers excluded from Consumer Financial Protection Bureau jurisdiction; most other users follow the CFPB's equivalent in Regulation V.

Timeline and current status

As of November 2026 the eCFR shows no changes to Part 681 since January 2017. The rule is in force; check the eCFR and the annual penalty adjustment before quoting figures.

Enforcement and penalties

The FTC enforces Part 681 for entities under its jurisdiction, while the SEC enforces Regulation S-ID and the federal banking agencies and the CFTC apply parallel rules to the firms they supervise. The FTC's civil penalty schedule in 16 CFR 1.98(m) lists $4,983 per violation for FCRA section 621(a)(2), applicable to penalties assessed after 17 January 2025; amounts are adjusted for inflation each year. Beyond penalties, a missing or paper-only programme is a recurring examination finding, and a weak programme raises fraud losses directly. The Synthetic Identity Fraud Guide covers a fraud type that a static red flag list tends to miss.

What it means for AI agents and non-human identities

• Automated channels are access methods: the covered account assessment must consider how accounts are opened and accessed. APIs, open banking connections and AI agents acting for customers are access methods, and each needs its own red flags, such as a new third-party token followed by a change of contact details.
• Agent-initiated changes need verification: when an AI assistant or aggregator submits an address change or card request on a customer's behalf, the 30-day card issuer rule still applies. Notify the cardholder through the established channel, not the channel the agent used.
• Detection systems are service identities: fraud scoring engines, document verification APIs and transaction monitoring tools run on service accounts and API keys. If an attacker can alter their rules or suppress their alerts, the programme fails silently. Restrict who and what can change detection logic, and log changes.
• Service providers include AI vendors: a provider whose model makes account opening or authentication decisions performs activities on covered accounts, so contract terms should require red flag detection, reporting and response.
• Synthetic and AI-generated identities: deepfaked selfies and generated documents map to the suspicious documents category; update the red flag register as these methods change, which is exactly what the update element requires.

See the Account Takeover Prevention Guide for existing-account controls.

Compliance steps

1. Determine coverage. Apply the creditor and financial institution tests to each business line and record the answer.
2. Assess accounts. List every account type, how it is opened and accessed (branch, web, app, phone, API, agent), and its fraud history; classify covered accounts.
3. Build the red flag register. Start from the 26 Supplement A examples, keep the relevant ones, add the firm's own patterns, and map each to a detection source.
4. Write response playbooks. For each red flag, set proportionate actions and owners, including when to stop, escalate or notify law enforcement.
5. Cover the address rules. Implement 30-day card request checks with separate notices and address discrepancy handling.
6. Oversee providers. Add red flag duties to contracts for account opening, servicing, collections and AI decision vendors, and collect periodic reports.
7. Get board approval and train. Present the written programme for approval, assign an administrator, and train the staff who handle accounts.
8. Report and update annually. Produce the annual report and revise the register from fraud data and product changes.

Metrics

• Red flag coverage: share of register entries with a working detection source and tested alert.
• Time to respond: median time from red flag alert to documented response.
• Identity theft losses: confirmed identity theft cases and losses per 10,000 new accounts, by channel.
• False positive rate: share of alerts closed as legitimate, to tune friction.
• Provider reporting: share of in-scope service providers reporting on red flags in the last 12 months.

Framework mapping

Common failure patterns

• A shelf document: the FTC stresses that a written programme alone does not reduce risk; detection must be built into operations.
• Never reassessing coverage: a new buy-now-pay-later product or app channel can create covered accounts the original assessment missed.
• Relying on knowledge-based questions: SSN and date of birth checks are unreliable authenticators.
• Ignoring providers: outsourced call centres and collection agencies handle red flags but are not contracted to act on them.
• No annual report: boards approve the first programme and never see it again.

Practitioner checklist

• Record the creditor and financial institution determination for each business line.
• Repeat the covered account assessment at least annually and on new products or channels.
• Maintain a red flag register mapped to detection sources and response playbooks.
• Include API, aggregator and AI agent access in the risk assessment and red flags.
• Enforce 30-day card request checks with separate notices to the former address or agreed channel.
• Handle address discrepancy notices and furnish confirmed addresses.
• Put red flag duties into service provider contracts, including AI decision vendors.
• Obtain board approval, train staff and deliver an annual report.
• Protect fraud detection systems' service accounts and rule changes with access control and logging.

Standards and references

• eCFR: 16 CFR Part 681, Identity Theft Rules
• Federal Trade Commission: Fighting Identity Theft with the Red Flags Rule, A How-To Guide for Business
• eCFR: 17 CFR Part 248 Subpart C, Regulation S-ID
• eCFR: 16 CFR 641.1, Duties of Users Regarding Address Discrepancies
• eCFR: 16 CFR 1.98, Adjustment of Civil Monetary Penalty Amounts
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev 5, Security and Privacy Controls

Related NHI Mgmt Group resources: GLBA Safeguards Rule Guide · Identity Proofing and KYC Guide · Synthetic Identity Fraud Guide · Identity Theft Recovery Guide. This guide summarises the FTC Red Flags Rule, Regulation S-ID and related rules and is not legal advice.