On October 22, 2008, the Federal Trade Commission announced a six-month delay in FTC enforcement of the "Red Flags Rule." The rule requires certain financial institutions and creditors to develop and implement Identity Theft Prevention Programs to prevent, detect, and mitigate identity theft in connection with certain covered accounts. See 16 C.F.R. § 681.2. Under the new timetable, those financial institutions and creditors subject to the FTC's enforcement jurisdiction under the Fair Credit Reporting Act will have until May 1, 2009, to achieve compliance. This does not affect the November 1, 2008, enforcement deadline for rules (1) requiring issuers of credit and debit cards to develop policies and procedures to assess the validity of an address change request when that request is followed closely by a request for an additional or replacement card, 16 C.F.R. § 681.3; and (2) requiring users of consumer credit reports to develop policies and procedures to respond to notices from credit reporting agencies regarding address discrepancies, 16 C.F.R. § 681.1.

The extension was necessary in part because of the expansive reach of the rule, which applies to finance companies, automobile dealers, mortgage brokers, utility companies, telecommunications companies, and entities (including certain broker-dealers and mutual fund companies) that provide "transaction accounts," including credit card accounts, checking accounts, and margin accounts. As the FTC explained in the Enforcement Policy Statement, "some industries and entities within the FTC's jurisdiction have expressed confusion and uncertainty about their coverage under the rule . . . [and] were not aware that they were undertaking activities that would cause them to fall within FACTA's definitions of 'creditor' or 'financial institution.'" Furthermore, many entities had informed the FTC "that because they generally are not required to comply with FTC rules in other contexts, they had not followed or even been aware of the rulemaking, and therefore learned of the requirements of the rule too late to be able to come into compliance by November 1, 2008."

It is important to note that the deadline for enforcement of the "Red Flags Rule" for financial institutions and creditors regulated by the federal bank regulatory agencies or the National Credit Union Administration has not been extended by those agencies. Although those agencies could extend their enforcement deadlines, there does not appear to have been the same level of confusion about the applicability of the rule with respect to these entities.