In 2003, Congress passed legislation intended to curb identity theft, and the Federal Trade Commission (FTC) subsequently issued a "Red Flags" Rule that requires creditors or financial institutions with covered accounts to have in place programs to assist in identifying a potential identity theft.
At the request of several Members of Congress, the Federal Trade Commission (“FTC”) announced, on May 28th, 2010, that it is further delaying enforcement of the “Red Flags” Rule (“Rule”) through December 31, 2010. This action does not affect other federal agencies’ enforcement of the original November 1, 2008 deadline for institutions subject to their oversight to be in compliance.
While CPA Firms may be exempt from the Red Flags Rule, their clients may not be. The following resources on the Red Flags Rule may be helpful when assisting clients.
A Privacy Checklist for CPA Firms - This checklist provides CPA firms with practical illustration of selected Generally Accepted Privacy Principles (GAPP) in order to maintain privacy best practices within organizations.
Protecting Client Data: Is My Firm At Risk? - A simple checklist intended to quickly assess whether your firm is at risk of exposing your clients’ sensitive personal data.
Protecting Confidential Client Data (Powerpoint) – A sample PowerPoint presentation that CPAs can use to educate their clients, employees, and/or firm management regarding the proper handling of sensitive digital information, and the effective use security technology to help reduce risk.
ADDITIONAL RESOURCES - A list of additional resources on the Red Flags Rule and Identity Theft.
Federal Trade Commission
Federal Register Notice
Fighting Fraud With the Red Flags Rule: A How to Guide for Business
The Red Flags Rule: Frequently Asked Questions
FTC FACT Act Red Flags Rule Template
AICPA
Final Rules on Identity Theft Red Flags and Notices of Address Discrepancy
Protecting Personal Information: 10 Steps a Business Can Follow to Avoid Identity Theft
Preventing Identity Theft Throughout the Data Life Cycle
Help Prevent Identity Theft
AICPA/CICA Generally Accepted Privacy Principles