Over six days in April 2016, callers posing as contractor representatives of Voya Financial Advisors, a broker dealer and investment adviser, rang the firm's technical support line. They asked for password resets. Two of the calls came from numbers Voya had already tied to earlier fraud. Support staff reset three passwords and read out temporary ones over the phone. With those logins the intruders reached personal data of at least 5,600 customers, the SEC's Voya order found. The firm's written identity theft program dated from 2009. It had not been substantively updated since. The Red Flags Rule is written against that gap. It makes identity theft, one type of fraud, a risk that a lender, bank or broker plans for on paper and keeps planning for.
What is FACTA, and what does the Red Flags Rule require?
FACTA is the Fair and Accurate Credit Transactions Act of 2003, approved on 4 December 2003 to amend the Fair Credit Reporting Act (FCRA) and to prevent identity theft. The SEC and CFTC's joint Red Flags rule of 2013 shortens the name to the FACT Act. Its other sections set duties for credit bureaus, the firms that use their reports and the merchants that print card receipts. They cover fraud and active duty alerts (section 112), shortened card numbers on receipts (113), victims' rights and the blocking of fraudulent data (151 and 152), free consumer reports (211), disposal of report data (216) and reconciling addresses (315).
Section 114 creates the program duty. It added subsection (e) to section 615 of the FCRA, which tells the agencies to require "each financial institution and each creditor" to set policies and procedures for implementing red flag guidelines. FACTA is a different law from FATCA, the Foreign Account Tax Compliance Act, which governs tax reporting on accounts; the two acronyms swap one pair of letters.
A red flag is a pattern, practice or specific activity that points to possible identity theft. In the SEC and CFTC texts, identity theft is the fraud itself, committed or attempted with someone else's identifying information without authority, so the term overlaps with identity fraud. Congress named one red flag itself. The agencies had to consider a guideline for a transaction on a credit or deposit account inactive for more than two years: the firm follows procedures that notify the consumer. Picture a savings account untouched since 2023 that suddenly sends a wire.
Who must run an identity theft prevention program?
A firm needs a written program when it is a financial institution or a creditor and offers or maintains a covered account. Four checks settle it, and the last one repeats.
- A financial institution or a creditor. Banks, savings associations, credit unions, brokers and futures firms each fall under one agency's version (Table 1). Why: the supervisor decides which text the examiner reads.
- A creditor in the 2010 sense. Since 18 December 2010, the Red Flag Program Clarification Act of 2010 counts a creditor only if it regularly obtains or uses consumer reports for credit, furnishes data to credit bureaus, or advances funds that must be repaid. Funds advanced only for expenses incidental to the creditor's own service do not count. An agency may add other creditor types by rule. Why: a clinic or hospital comes under the rule only through one of those three tests.
- A covered account. A consumer account built for multiple payments or transactions (credit card, mortgage, car loan, margin, phone, utility, checking or savings), or any other account with a reasonably foreseeable identity theft risk to customers or to the firm's safety and soundness. Why: the second leg can bring in business accounts.
- A determination that is repeated. The firm must periodically determine whether it offers covered accounts, weighing how accounts open, how they are accessed and its past experience of identity theft. Why: a lender that adds app onboarding has changed two of the three.
Which agency's Red Flags Rule applies to your firm?
The supervisor decides. Section 615(e) of the FCRA tells the federal banking agencies, the NCUA, the FTC, the CFTC and the SEC to act jointly, so seven texts run side by side.
Table 1. Seven versions of the Red Flags Rule (Code of Federal Regulations, read 12 November 2026)
| Agency | Rule | Firms it covers | Example firm (illustrative type) | Card issuer section |
|---|---|---|---|---|
| FTC | 16 CFR 681.1 | Financial institutions and creditors under FTC enforcement of the FCRA | A nonbank consumer lender | 681.2 |
| OCC | 12 CFR 41.90 | National banks, federal savings associations, and foreign banks' federal branches and agencies | A national bank | 41.91 |
| Federal Reserve | 12 CFR 222.90 | State member banks and listed offices of foreign banks | A state bank in the Fed system | 222.91 |
| FDIC | 12 CFR 334.90 | Insured state nonmember banks and insured state savings associations | A state community bank outside the Fed | 334.91 |
| NCUA | 12 CFR 717.90 | Federal credit unions | A federal credit union | 717.91 |
| SEC | Regulation S-ID, 17 CFR 248.201 | Broker dealers, investment companies, registered investment advisers | An online broker | 248.202 |
| CFTC | 17 CFR 162.30 | Futures commission merchants, retail forex dealers, commodity trading advisors, pool operators, introducing brokers, swap dealers and major swap participants | A futures broker holding margin accounts | 162.32 |
All seven texts set the same four program elements. The guidelines sit in Appendix J for the three banking agencies and the NCUA, in Appendix A for the FTC and the SEC and in Appendix B for the CFTC. The OCC's text adds that its examples "are not exclusive". The SEC and CFTC joined in 2013. Their joint rule was published on 19 April 2013 and took effect on 20 May 2013; Voya had written its 2009 program under the FTC's text.
For a newly formed SEC registrant with covered accounts, SEC staff estimate 25 hours to develop a program and win board approval, plus 4 hours to train staff. The OCC counts 1,172 respondents for its red flags and address discrepancy collection.
What must a written identity theft prevention program contain?
The rule asks for a written program "appropriate to the size and complexity" of the firm and the nature and scope of its activities, and it names no technology or product. The program rests on four elements and four administration duties.
Table 2. What the program must do, element by element (16 CFR 681.1 and Appendix A)
| Element | What the rule says (cite) | Record an examiner asks for (example) | Who decides |
|---|---|---|---|
| Identify | Relevant red flags for each covered account, built into the program ((d)(2)(i)) | Flag list by account type and opening channel, with the reason for each | Program owner; board approves the first version |
| Detect | Catch the listed flags ((d)(2)(ii)) | The onboarding and account controls mapped to each flag | Fraud and operations teams |
| Respond | Respond appropriately to prevent and mitigate ((d)(2)(iii)) | A response per flag and closed cases that show it used | Analyst on the case, escalation as the program sets |
| Update | Update periodically as risks change ((d)(2)(iv); App. A V) | Dated change log tied to incidents, products and partners | Board, committee or senior manager for material changes |
| Approve and oversee | Board or committee approves; board, committee or senior manager oversees ((e)(1), (e)(2)) | Approval minute; named senior manager | Board or committee |
| Train | Train staff as necessary ((e)(3)) | Attendance by role and date | Program owner |
| Service providers | Appropriate and effective oversight ((e)(4); App. A VI(c)) | Contract terms on detecting and reporting flags | Firm, through vendor oversight |
| Annual report | At least annually (App. A VI(b)) | Report on effectiveness, providers, significant incidents, proposed changes | Staff report; board, committee or senior manager reads |
Each row in Table 2 leaves a document behind when it runs, and a customer risk score that feeds the detect step needs a trail of its own. complead, formerly Sanction Scanner, stamps the model version on each rating in complead's customer risk assessment. The rating can then be defended after the model changes. The identity arrives already verified by the firm's IDV provider, and the customer is rescored whenever behavior, exposure or screening results move, at the event itself or on a set schedule.
The firm must also consider the Appendix A guidelines and include those that fit. Where a fintech partner or an outside call center handles part of the work, Appendix A suggests a contract that makes the provider detect the flags it meets and either report them or act to prevent the theft.
Appendix A gives five triggers for an update: the firm's own identity theft experience, new theft methods, new ways to detect and prevent theft, new account types, and changed business arrangements such as mergers, joint ventures and service providers. Public identity theft statistics feed the second trigger when one method is rising.
The annual report goes to the board, a committee or the designated senior manager. It covers how well the program works, service provider arrangements, significant incidents with management's response, and recommended material changes.
Which red flags belong in your program, and why is copying Supplement A not enough?
TradeStation's program listed a red flag for an ID photo that does not match the person presenting it. Nearly all its accounts were opened online. Staff never had a face to compare it with, the SEC's TradeStation order found. The program also copied eight consumer report flags, though the firm did not obtain and review consumer reports when it opened accounts.
The J.P. Morgan Securities order faulted programs that listed every illustrative example verbatim without saying how staff would spot or answer any of them. UBS, per the UBS order, listed general categories of activity and named no red flag its employees should watch for. In each order the SEC found no reasonable policies to identify the red flags relevant to the firm's own business.
Supplement A is a menu. Its 26 numbered examples sit under five headings, and a firm "may consider incorporating" any of them. Appendix A asks the firm to weigh four risk factors: the types of covered accounts, how they open, how they are accessed and past incidents. Its sources include the firm's own incidents, changes in theft methods and supervisory guidance. Three flags chosen that way:
- Cash out on new credit (item 20). A new revolving line goes mostly to cash advances or goods that resell easily, or the first payment never arrives.
- A new transfer pattern (item 21). A deposit account's electronic fund transfers change materially.
- A card after an address change (16 CFR 681.2). Picture a card issuer that logs an address change on Monday and a replacement card request on Thursday. Within at least the first 30 days after the notice, the issuer may not send the card until it has notified the cardholder at the old address or by another agreed channel. The issuer must also give the cardholder a reasonable means of promptly reporting an incorrect address change. Instead of both steps, its policies may let it assess the change another way.
Supplement A dates from 2007 and never uses the word synthetic, so flags for synthetic identity fraud have to come from sources such as the firm's own incidents, changes in theft methods or supervisory guidance. Items 19 to 25 can only fire once an account is in use.
How does the program sit next to CIP and AML monitoring?
FACTA links the two itself: the red flag guidelines "shall not be inconsistent with" the customer identification program (CIP) rules under section 5318(l) of Title 31. Appendix A lets the detect step use CIP procedures for anyone opening a covered account. The FTC's text still cites 31 CFR 103.121; for banks, the customer identification program rule now sits at 31 CFR 1020.220.
For existing accounts, Appendix A describes detection as authenticating customers, monitoring transactions and verifying change of address requests. Section 315 adds an address duty. A notice of address discrepancy tells a user of consumer reports that the address it supplied differs substantially from the addresses in the agency's file. Supplement A lists such a notice as red flag 3. The user needs procedures to form a reasonable belief that the report relates to its consumer, under the CFPB's 12 CFR 1022.82 or, for car dealers outside CFPB reach, the FTC's 16 CFR 641.1.
The examples include comparing the report with CIP information or with records the firm already holds.
Other duties run beside the program. Among them, Appendix A names a suspicious activity report where section 5318(g) of Title 31 applies, the conditions for extending credit when a fraud or active duty alert appears, and the ban on selling, transferring or placing for collection certain debts that resulted from identity theft.
What has a weak program cost firms?
The first SEC enforcement action under the rule was Voya's, announced on 26 September 2018 and settled on charges under the Red Flags Rule and the SEC's Safeguards Rule for customer data. Voya agreed to a $1 million penalty. The order found no substantive update to the program after 2009, no administration or oversight by the board or a designated manager, and no training specific to the program. Sessions that touched on identity theft drew three employees in 2015 and five in 2016.
On 27 July 2022 the SEC settled with J.P. Morgan Securities ($1.2 million), UBS ($925,000) and TradeStation ($425,000), whose programs from at least January 2017 to October 2019 lacked reasonable policies to identify relevant red flags. Two SEC lists read on 12 November 2026 show no later action under Regulation S-ID. The cyber enforcement list, last updated 24 April 2025, names four later actions against regulated entities, none under it. No SEC press release from 15 January 2025 to 10 November 2026 carries an identity theft or Regulation S-ID title.
The FTC can sue over a knowing violation that forms a pattern or practice. The FCRA sets up to $2,500 per violation, which 16 CFR 1.98 adjusts for inflation to $4,983.
What changed in 2026?
- 17 June 2026. The CFTC asked the Office of Management and Budget (OMB) to reinstate without change its Part 162 information collection. Its estimate of 3,510 respondents covers the whole part, privacy and disposal rules included, not red flag programs alone.
- 15 September 2026. The FTC kept its 2025 civil penalty levels for 2026, after OMB guidance of 17 April 2026 canceled that year's adjustment, so $4,983 stands.
- No amendment. 16 CFR 681, current to 9 November 2026 on eCFR, still carries its last changes of 14 May 2009 and 6 December 2012.
Set the Voya facts against the four elements. Identify: Voya kept a monitoring list of suspect phone numbers, yet no written procedure told support staff to use it, and two reset calls came from those numbers. Detect: three hours after the first call, a representative reported a password change nobody had asked for. Respond: Appendix A lists changing passwords and security codes, and the order found Voya had no reasonable procedure to change security codes once intruders were in. Update: a 2009 program, a 2016 attack. This quarter, have a colleague call your own support line asking for a reset, and see which flag fires.
