Interim final rule; request for comment.
The Federal Trade Commission (“FTC” or “Commission”) is amending its Red Flags Rule promulgated under Section 615 of the Fair Credit Reporting Act (FCRA), to implement the Red Flag Program Clarification Act of 2010 (Clarification Act or Act). The interim final rule amends the definition of “creditor” in the original Red Flags Rule to make it consistent with the revised definition of that term in the Clarification Act.
The interim final rule is effective on February 11, 2013. Written comments must be received on or before February 11, 2013.
Interested parties may file a comment online or on paper, by following the instructions in the Request for Comments part of the SUPPLEMENTARY INFORMATION section below. Write “Red Flags Interim Final Rule” on your comment, and file your comment online at https://ftcpublic.commentworks.com/ftc/redflagsinterimrule by following the instructions on the web-based form. If you prefer to file your comment on paper, mail or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex M), 600 Pennsylvania Avenue NW., Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT:
Steven Toporoff, Attorney, or Tiffany George, Attorney, Federal Trade Commission, Division of Privacy and Identity Protection, Bureau of Consumer Protection, (202) 326-2252, 600 Pennsylvania Avenue NW., Washington, DC 20580.
On November 9, 2007, the Commission and banking agencies published final rules and guidelines 
to implement the red flags provisions of section 615 of the FCRA.
Section 615 directed the Commission and banking agencies to issue joint regulations and guidelines requiring “financial institutions” and “creditors” to develop and implement a written identity theft program to identify, detect, and respond to possible risks of identity theft relevant to them.
The final Commission rule (the Red Flags Rule) 
included the definition of “creditor,” as set forth in section 603(r)(5) of the FCRA.
That definition references the definition of “creditor” in section 702 of the Equal Credit Opportunity Act (ECOA). The ECOA defines the term “creditor” broadly as “any person who regularly extends, renews, or continues credit; any person who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew or continue credit.” 
The ECOA further defines “credit” as “the right granted by a creditor to a debtor to defer payment of debt or to incur debts and defer its payment or to purchase property or services and defer payment therefor.” 
The final rule, therefore, defined the term “creditor” in this manner. The definition included businesses or organizations that regularly provide goods or services first and allow consumers to pay later.
It also covered businesses or organizations that regularly grant loans, arrange for loans or the extension of credit, or make credit decisions, as well as those who regularly participate in the decision to extend, renew, or continue credit, including setting the terms of credit.
II. The Red Flag Program Clarification Act
In December 2010, Congress enacted the Red Flag Program Clarification Act (Clarification Act), 15 U.S.C. 1681m(e)(4), which narrows the scope of entities covered as “creditors” under the Red Flags Rule.
The Clarification Act retains the ECOA definition of “creditor,” but generally limits the application of the Red Flags Rule to those ECOA creditors that regularly and in the ordinary course of business engage in at least one of the following three types of conduct: 
1. Obtain or use consumer reports, directly or indirectly, in connection with a credit transaction; 
2. Furnish information to consumer reporting agencies in connection with a credit transaction; 
3. Advance funds to or on behalf of a person, based on an obligation of the person to repay the funds or repayable from specific property pledged by or on behalf of the person.
In addition to limiting the scope of coverage for “creditors” by creating these specified categories, the Clarification Act empowers the Commission, banking agencies, CFTC, and SEC 
to determine through a future rulemaking whether to include any other type of creditor that offers or maintains accounts that are subject to a reasonably foreseeable risk of identity theft.
At this time, the Commission does not intend to use its discretionary rulemaking to extend coverage of the Red Flags Rule to additional creditors.
III. The Amended Definition of “Creditor”
Pursuant to the Clarification Act, the definition of “creditor” is amended to ensure that it is consistent with the amended text of the FCRA. Accordingly, the FTC is amending its regulations applicable to the entities subject to its jurisdiction to clarify that the definition of “creditor” set forth in the interim final rule has the same meaning as in 15 U.S.C. 1681m(e)(4).
A. Regularly and in the Ordinary Course of Business
By referencing the statutory definition of creditor, the interim final rule limits the definition of “creditor” to those ECOA creditors that “regularly and in the ordinary course of business” engage in the specific conduct set forth in the Clarification Act.
“Regularly and in the ordinary course of business” excludes isolated conduct.
B. Obtains or Uses Consumer Reports
A “creditor” will be covered by the interim final rule if it regularly and in the ordinary course of its business obtains or uses consumer reports, directly or indirectly, in connection with a credit transaction. This includes any use of a consumer report in connection with a credit transaction, even if the report is not directly obtained by the creditor and even if the creditor uses a service provider to make the credit determination. For this reason, a creditor that engages a third-party servicer to obtain consumer report information on its behalf, or to evaluate a consumer's creditworthiness based upon the consumer's report, is a “creditor” under this prong for purposes of the interim final rule.
The Commission notes that for this prong to apply, the creditor must use or obtain a consumer report “in connection with a credit transaction.” Accordingly, the use of consumer reports for purposes other than credit B such as employment B will not trigger coverage under the interim final rule's definition of “creditor.”
C. Furnishing Information to Credit Reporting Agencies
A creditor will be covered by the interim final rule if it regularly and in the ordinary course of business furnishes information to a consumer reporting agency, as described in section 623 of the FCRA, in connection with a credit transaction.
D. Advancing Funds
Further, a creditor will be covered by the interim final rule if it regularly and in the ordinary course of business advances funds to a person, or on behalf of a person, where that person is obligated to repay the funds or the funds are repayable from pledged specific property by or on behalf of the person.
This prong covers those lenders, such as payday lenders and automobile title lenders, that may not typically obtain, use, or furnish consumer reports in the ordinary course of business, but lend money to or on behalf of consumers and thus may be attractive targets for identity thieves. Consistent with the statutory language, the term “creditor” includes not only those creditors that lend money directly to a consumer, but also those creditors that advance funds to a third party “on behalf of a person.” Thus, for example, a finance company that provides funds to a furniture store related to a person's purchase of furniture would be covered under this prong because it is advancing funds “on behalf of a person.”
At the same time, the interim final rule provides that the term “advancing funds” does not include a creditor that advances funds “on behalf of a person for expenses incidental to a service provided by the creditor to that person.” This limitation makes clear that advancing funds does not include payment in advance for fees, materials, or services that are incidental to the creditor's ability to provide another service that a person initiated or requested. Accordingly, a lawyer, for example, who advances funds on behalf of a client to pay expert witness fees or other expenses that are incidental to a request by a client for the provision of legal services in the course of litigation will not be deemed to be “advancing funds.” Thus, unlike a commercial lender making a loan, a business will not be deemed a creditor merely by advancing funds and deferring payment for fees incurred in the course of providing services to a client or customer.
E. Discretionary Rulemaking Authority
Finally, the Clarification Act provides that the definition of “creditor” includes any other type of creditor that an agency with jurisdiction determines, through a rulemaking, offers or maintains accounts that are subject to a reasonably foreseeable risk of identity theft. At this time, the Commission is not initiating discretionary rulemaking to extend coverage of the Red Flags Rule to additional creditors.
IV. Good Cause for Interim Final Rule
The Commission finds good cause for adopting the interim final rule without advance public notice and opportunity for public comment. Advance public notice and comment are not required “when the agency for good cause finds (and incorporates the finding and a brief statement of reasons therefore in the rules issued) that notice and public procedure thereon are impracticable, unnecessary, or contrary to the public interest.” 
As discussed above, the Clarification Act amends the definition of “creditor” for purposes of the Red Flags Rule. This amendment necessitates a technical revision of the Red Flags Rule to ensure that the regulation is consistent with the text of the amended FCRA.
The Commission finds that prior public comment on the Rule is unnecessary because the Commission has merely codified the amended statutory definition of “creditor.” Delay in adoption of the rule revision to allow for prior public comment would prolong uncertainty about the applicability of the Red Flags Rule requirements to the class of “creditors,” as defined in the amended FCRA. As a result, adoption of this amendment serves the public interest by providing clarity to the public regarding the entities that are subject to the Rule and furthering the effectiveness of the Commission's ongoing efforts to prevent identity theft and fraud through the enforcement of the Rule.
Accordingly, the Commission finds that there is good cause for adopting this interim final rule as effective on February 11, 2013, without prior public comment. Nonetheless, in order to promote good and open government, the Commission exercises its discretion to invite public comment on the interim final rule. Based on comments received, the Commission may adjust the interim final rule as necessary.
V. Request for Comments
You can file a comment online or on paper. For the Commission to consider your comment, we must receive it on or before February 11, 2013. Write “Red Flags Interim Final Rule,” on your comment. Your comment—including your name and your state—will be placed on the public record of this proceeding, including, to the extent practicable, on the public Commission Web site, at http://www/ftc/gov/os/publiccomments.shtm. As a matter of discretion, the Commission tries to remove individuals' home contact information from comments before placing them on the Commission Web site.
Because your comment will be made public, you are solely responsible for making sure that your comment doesn't include any sensitive personal information, such as anyone's Social Security number, date of birth, driver's license number or other state identification number or foreign country equivalent, passport number, financial account number, or credit or debit card number. You are also solely responsible for making sure that your comment doesn't include any sensitive health information, such as medical records or other individually identifiable health information. In addition, don't include any `[t]rade secret or any commercial or financial information which is obtained from any person and which is privileged or confidential,” as provided in Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2). In particular, don't include competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names.
If you want the Commission to give your comment confidential treatment, you must file it in paper form, with a request for confidential treatment, and you have to follow the procedure explained in FTC Rule 4.9(c), 16 CFR 4.9(c).
Your comment will be kept confidential only if the FTC General Counsel, in his or her sole discretion, grants your request in accordance with the law and the public interest.
Postal mail addressed to the Commission is subject to delay due to heightened security screening. As a result, we encourage you to submit your comments online. To make sure that the Commission considers your online comment, you must file it at https://ftcpublic.commentworks.com/ftc/redflagsinterimrule, by following the instruction on the web-based form. If this Notice appears at http://www.regulations.gov/serach/Regs/home.html#home, you may also file a comment through that Web site.
If you file your comment on paper, write “Red Flags Interim Final Rule” on your comment and on the envelope, and mail or deliver it to the following address: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex M), 600 Pennsylvania Avenue NW., Washington, DC 20580. If possible, submit your paper comment to the Commission by courier or overnight service.
VI. Communications by Outside Parties to the Commissioners or Their Advisors
Written communications and summaries of transcripts of oral communications respecting the merits of this proceeding from any outside party to any Commissioner will be placed on the public record.
VII. Regulatory Analysis
A. Paperwork Reduction Act
The interim final rule does not include any new information collection requirements under the provisions of the Paperwork Reduction Act of 1995 (PRA).
Nonetheless, the Commission anticipates that the narrowed definition of the term “creditor” will result in a decrease in the number of creditors covered by the Red Flags Rule. Commission staff has proposed revised estimates of hours and costs “burden” under the PRA in connection with the FTC's pursuit of renewed OMB clearance for the Red Flags Rule (under OMB Control No 3084-0137), which currently runs through November 30, 2012. These estimates, which factor in the anticipated effects of the amended Rule, appear separately in the Federal Register for public comment.
B. Regulatory Flexibility Act
The Regulatory Flexibility Act (RFA), 5 U.S.C. 601-612, requires that the Commission provide an Initial Regulatory Flexibility Analysis (IRFA) with a proposed rule and a Final Regulatory Flexibility Analysis (FRFA), if any, with a final rule. As noted above, the Commission finds that good cause exists for adopting this interim final rule without advance public notice or an opportunity for public comment. Because notice and comment is not statutorily required, the requirement to publish an analysis under the Regulatory Flexibility Act does not apply in this proceeding.
For the reasons discussed in the preamble, the Commission amends part 681 of title 16 of the Code of Federal Regulations as follows:
PART 681—IDENTITY THEFT RULES
1. Revise the authority citation for part 681 to read as follows:
2. Revise 681.1(b)(5) to read as follows:
Duties regarding the detection, prevention, and mitigation of identity theft.
* * * * *
(b) * * *
(5) Creditor has the same meaning as in 15 U.S.C. 1681m(e)(4).
* * * * *
By direction of the Commission.
Donald S. Clark,
[FR Doc. 2012-29430 Filed 12-5-12; 8:45 am]
BILLING CODE 6750-01-P