Sheppard Mullin Financial Institutions Law Blog

Several federal regulatory agencies have adopted final rules requiring financial institutions and other creditors to adopt policies aimed at fighting identity theft. The rules require the adoption of an Identity Theft Prevention Program, and took effect January 1, 2008, although covered financial institutions and other creditors have until November 1, 2008 to comply.

The five federal financial regulatory agencies have jointly issued final regulations implementing Section 214 of the Fair and Accurate Credit Transactions Act (FACTA), which amends the Fair Credit Reporting Act (FCRA). The regulations allow consumers to opt out and prevent a financial institution from using information provided by an affiliated company to market its products and services to the consumer. These regulations impose requirements for information sharing that exceed the requirements of the Gramm-Leech-Bliley Act, which impose no limitations upon information sharing with affiliates. These new regulations also do not supersede or replace existing provisions in Section 603 of FCRA concerning the consumer's right to opt out of allowing consumer information, including credit report or credit information on the consumer taken from other sources, other than transaction and experience information to be shared between affiliates. A financial institution's failure to comply with these regulations may result in the financial institution being treated as a consumer reporting agency under FCRA.