[Code of Federal Regulations]
[Title 12, Volume 1]
[Revised as of January 1, 2008]
From the U.S. Government Printing Office via GPO Access
[CITE: 12CFR41.90]

[Page 458-459]
 
                       TITLE 12--BANKS AND BANKING
 
   CHAPTER I--COMPTROLLER OF THE CURRENCY, DEPARTMENT OF THE TREASURY
 
PART 41_FAIR CREDIT REPORTING--Table of Contents
 
                   Subpart J_Identity Theft Red Flags
 
Sec. 41.90  Duties regarding the detection, prevention, and mitigation of identity theft.

    Source: 72 FR 63753, Nov. 9, 2007, unless otherwise noted.


    (a) Scope. This section applies to a financial institution or 
creditor that is a national bank, Federal branch or agency of a foreign 
bank, and any of their operating subsidiaries that are not functionally 
regulated within the meaning of section 5(c)(5) of the Bank Holding 
Company Act of 1956, as amended (12 U.S.C. 1844(c)(5)).
    (b) Definitions. For purposes of this section and Appendix J, the 
following definitions apply:
    (1) Account means a continuing relationship established by a person 
with a financial institution or creditor to obtain a product or service 
for personal, family, household or business purposes. Account includes:
    (i) An extension of credit, such as the purchase of property or 
services involving a deferred payment; and
    (ii) A deposit account.
    (2) The term board of directors includes:
    (i) In the case of a branch or agency of a foreign bank, the 
managing official in charge of the branch or agency; and
    (ii) In the case of any other creditor that does not have a board of 
directors, a designated employee at the level of senior management.
    (3) Covered account means:
    (i) An account that a financial institution or creditor offers or 
maintains, primarily for personal, family, or household purposes, that 
involves or is designed to permit multiple payments or transactions, 
such as a credit card account, mortgage loan, automobile loan, margin 
account, cell phone account, utility account, checking account, or 
savings account; and
    (ii) Any other account that the financial institution or creditor 
offers or maintains for which there is a reasonably foreseeable risk to 
customers or to the safety and soundness of the financial institution or 
creditor from identity theft, including financial, operational, 
compliance, reputation, or litigation risks.
    (4) Credit has the same meaning as in 15 U.S.C. 1681a(r)(5).
    (5) Creditor has the same meaning as in 15 U.S.C. 1681a(r)(5), and 
includes lenders such as banks, finance companies, automobile dealers, 
mortgage brokers, utility companies, and telecommunications companies.
    (6) Customer means a person that has a covered account with a 
financial institution or creditor.
    (7) Financial institution has the same meaning as in 15 U.S.C. 
1681a(t).
    (8) Identity theft has the same meaning as in 16 CFR 603.2(a).
    (9) Red Flag means a pattern, practice, or specific activity that 
indicates the possible existence of identity theft.
    (10) Service provider means a person that provides a service 
directly to the financial institution or creditor.
    (c) Periodic Identification of Covered Accounts. Each financial 
institution or creditor must periodically determine whether it offers or 
maintains covered accounts. As a part of this determination, a financial 
institution or creditor must conduct a risk assessment to determine 
whether it offers or maintains covered accounts described in paragraph 
(b)(3)(ii) of this section, taking into consideration:
    (1) The methods it provides to open its accounts;
    (2) The methods it provides to access its accounts; and
    (3) Its previous experiences with identity theft.

[[Page 459]]

    (d) Establishment of an Identity Theft Prevention Program. (1) 
Program requirement. Each financial institution or creditor that offers 
or maintains one or more covered accounts must develop and implement a 
written Identity Theft Prevention Program (Program) that is designed to 
detect, prevent, and mitigate identity theft in connection with the 
opening of a covered account or any existing covered account. The 
Program must be appropriate to the size and complexity of the financial 
institution or creditor and the nature and scope of its activities.
    (2) Elements of the Program. The Program must include reasonable 
policies and procedures to:
    (i) Identify relevant Red Flags for the covered accounts that the 
financial institution or creditor offers or maintains, and incorporate 
those Red Flags into its Program;
    (ii) Detect Red Flags that have been incorporated into the Program 
of the financial institution or creditor;
    (iii) Respond appropriately to any Red Flags that are detected 
pursuant to paragraph (d)(2)(ii) of this section to prevent and mitigate 
identity theft; and
    (iv) Ensure the Program (including the Red Flags determined to be 
relevant) is updated periodically, to reflect changes in risks to 
customers and to the safety and soundness of the financial institution 
or creditor from identity theft.
    (e) Administration of the Program. Each financial institution or 
creditor that is required to implement a Program must provide for the 
continued administration of the Program and must:
    (1) Obtain approval of the initial written Program from either its 
board of directors or an appropriate committee of the board of 
directors;
    (2) Involve the board of directors, an appropriate committee 
thereof, or a designated employee at the level of senior management in 
the oversight, development, implementation and administration of the 
Program;
    (3) Train staff, as necessary, to effectively implement the Program; 
and
    (4) Exercise appropriate and effective oversight of service provider 
arrangements.
    (f) Guidelines. Each financial institution or creditor that is 
required to implement a Program must consider the guidelines in Appendix 
J of this part and include in its Program those guidelines that are 
appropriate.