Red Flags Rule

The Red Flags Rule is intended to protect consumers from identity theft by requiring organizations to proactively identify warning signs—or “red flags”—that indicate the potential for fraud. The rule aims to reduce the risk of financial harm by encouraging early detection and response.

1. Identification of relevant red flags that signal identity theft. 2. Detection methods for those red flags. 3. Response plans for when red flags are detected. 4. Periodic program updates to address new risks and changes in the threat landscape.

Banks and other covered entities must develop a written Identity Theft Prevention Program. This program must be approved at the board level, involve regular employee training, include appropriate oversight of service providers, and be tailored to the institution’s size, complexity, and scope of operations.