B-316999

August 29, 2008

The Honorable Christopher J. Dodd
Chairman
The Honorable Richard C. Shelby
Ranking Minority Member
Committee on Banking, Housing, and Urban Affairs
United States Senate

The Honorable Barney Frank
Chairman
The Honorable Spencer Bachus
Ranking Minority Member
Committee on Financial Services
House of Representatives

Subject: Federal Trade Commission: Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003

Pursuant to section 801(a)(2)(A) of title 5, United States Code, this is our report on a major rule promulgated by the Federal Trade Commission, entitled “Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003” (RIN: 3084-AA94). We received the rule on August 15, 2008. It was published in the Federal Register as “joint final rules and guidelines” rule on November 9, 2007. 72 Fed. Reg. 63,718.

The final rule was jointly issued by the Federal Trade Commission (Commission); Office of the Comptroller of the Currency, Treasury; Board of Governors of the Federal Reserve System; Federal Deposit Insurance Corporation; Office of Thrift Supervision, Treasury; and the National Credit Union Administration. The final rule implements several sections of the Fair and Accurate Credit Transactions Act of 2003. The final rule requires each financial institution or creditor to develop and implement a written Identity Theft Protection Program to detect, prevent, and mitigate identity theft in connection with the opening of certain accounts or certain existing accounts. The final rule also requires credit and debit card issuers to assess the validity of notifications of changes of address under certain circumstances. Finally, the final rule provides guidance regarding reasonable policies and procedures that a user of consumer reports must employ when a consumer reporting agency sends the user a notice of address discrepancy.

Enclosed is our assessment of the Commission’s compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. Our review indicates that the Commission complied with the applicable requirements.

If you have any questions about this report or wish to contact GAO officials responsible for the evaluation work relating to the subject matter of the rule, please contact Michael R. Volpe, Assistant General Counsel, at (202) 512-8236.

signed

Robert J. Cramer
Associate General Counsel

Enclosure

cc: Donald S. Clark
Secretary of the Commission
Federal Trade Commission

ENCLOSURE

REPORT UNDER 5 U.S.C. sect. 801(a)(2)(A) ON A MAJOR RULE
ISSUED BY THE
FEDERAL TRADE COMMISSION
ENTITLED
"IDENTITY THEFT RED FLAGS AND ADDRESS DISCREPANCIES
UNDER THE FAIR AND ACCURATE CREDIT TRANSACTIONS ACT OF 2003"
(RIN: 3084-AA94)

(i) Cost-benefit analysis

The Commission did not prepare a cost-benefit analysis. The Commission did determine that the annual costs of the information collection requirements would be over $150 million.

(ii) Agency actions relevant to the Regulatory Flexibility Act, 5 U.S.C. sections 603-605, 607, and 609

The Commission certified that the final rule will not have a significant economic impact on a substantial number of small business entities.

(iii) Agency actions relevant to sections 202-205 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. sections 1532-1535

As an independent regulatory and law enforcement agency, the Commission is not subject to title II of the Unfunded Mandates Reform Act of 1995.

(iv) Other relevant information or requirements under acts and executive orders

Administrative Procedure Act, 5 U.S.C. sections 551 et seq.

The Commission, along with the other agencies participating in the joint rulemaking, published a joint notice of proposed rulemaking in the Federal Register on July 18, 2006. 71 Fed. Reg. 40,786. The agencies received 129 comments in response to the proposed rulemaking. Those comments were responded to in the final rule.

Paperwork Reduction Act, 44 U.S.C. sections 3501-3520

The Commission estimates that the portion of the final rule implementing section 114 will have an average annual information collection burden of 4,466,000 hours and an associated estimated annual labor cost of $142,925,000. FTC estimates that the portion of the final rule implementing section 315 will have an average annual information collection burden of 831,000 hours and an associated estimated annual labor cost of $13,296,000.

Statutory authorization for the rule

This final rule is authorized by sections 114 and 315 of the Fair and Accurate Credit Transactions Act of 2003. Pub. L. 108-159, 117 Stat. 1952. 15 U.S.C. sections 1681c, 1681m.

Executive Order No. 12,866

As an independent agency, the Commission is not subject to the review requirements of the order.