Enforcement of Red Flags Rule Begins

ON-DEMAND: <a href="Distance_Learning/On-Demand_Webcasts/OD_Budget_Models_and_Process_Challenges_Facing_Institutions_Today.html">Budget Models and Process: Challenges Facing Institutions Today
ON-DEMAND: <a href="Distance_Learning/On-Demand_Webcasts/OD_Hiring_for_a_Global_Campus—Why_a_Textbook_Approach_Will_Not_Work.html">Hiring for a Global Campus—Why a Textbook Approach Will Not Work
ON-DEMAND: <a href="Distance_Learning/On-Demand_Webcasts/OD_Higher_Education_Analytics_and_Data_Driven_Decisions.html">Higher Education Analytics and Data Driven Decisions
ON-DEMAND: <a href="Distance_Learning/On-Demand_Webcasts/OD_Common_Compliance_Pitfalls_with_Study_Abroad_Programs.html">Common Compliance Pitfalls with Study Abroad Programs
ON-DEMAND: <a href="Distance_Learning/On-Demand_Webcasts/OD_Net_Tuition_Revenue_Price_and_Enrollment_How_Can_you_Achieve_Balance.html">Net Tuition Revenue, Price and Enrollment: How Can you Achieve Balance?

January 26, 2011

Beginning January 1, 2011, creditors with covered accounts need to be in compliance with the Federal Trade Commission's identity theft regulations, widely known as the Red Flags rule. Although the rule, requiring entities to have certain policies and practices in place, has been in effect for more than two years, repeated enforcement delays had been issued in the meantime while Congress considered changes to which entities would be covered.

In December, Congress finally acted, passing the Red Flag Program Clarification Act of 2010 (PL111-39). The changes are primarily designed to exempt small businesses, such as doctors' offices, accountants, and small stores, from the requirements. Most colleges and universities are unlikely to be affected by the modification of the definition of a creditor. (Note that neither the law nor the FTC regulations specify particular types of covered entities; the determination is made based on the activities in which an entity engages as part of its business.)

Under the new definition, an entity is a creditor if it regularly and in the ordinary course of business does one or more of the following:

1) obtains or uses consumer reports, directly or indirectly, in connection with a credit transaction;

2) furnishes information to consumer reporting agencies in connection with a credit transaction; or

3) advances funds to or on behalf of a person, based on an obligation of the person to repay the funds or repayable from specific property pledged by or on behalf of the person.

While higher education institutions don't normally use consumer credit reports, most do report to consumer credit agencies and advance funds (through tuition payment plans and federal and institutional loans) to help students cover their bills.

The FTC has not yet issued any guidance based on the new legislation. Institutions with questions about whether they are still covered by the rules should consult their legal counsel.