Coverage of FTC's Red Flags Rule Clarified

On Dec. 18, 2010, President Obama signed new legislation clarifying the coverage of the Federal Trade Commission’s Red Flags Rule. That rule requires financial institutions and a broadly defined category of “creditors” to maintain written identity theft protection programs. The original rule was worded so expansively that it seemed to cover even professional service providers who did not require clients to pay for services as soon as they were rendered. The new legislation – the Red Flag Program Clarification Act of 2010 – states that the rule applies only to creditors that regularly and in the ordinary course of business (1) obtain consumer credit reports in connection with credit transactions, (2) furnish information to consumer credit reporting agencies or (3) advance funds that the recipient is obligated to repay. The new definition of “creditor” expressly excludes businesses “that advance funds on behalf of a person for expenses incidental to a service provided by the creditor to that person.” This language is intended to allay fears that the rule would cover lawyers, health care providers and other professionals that are not usually thought of as creditors but are sometimes in the position of advancing expenses or deferring billing. The new law came about at least partially in response to lawsuits filed by the American Bar Association and the American Medical Association.