The SEC and the CFTC have proposed a new rule requiring certain entities to address identity theft (the “Rule”). Like the FTC’s Red Flags Rules, the Rule would require certain firms to develop and implement a written identity theft prevention program designed to detect, prevent, and mitigate identity theft. The Rule is proposed due to mandate in the Dodd-Frank Act.
The SEC acknowledged in the Rule proposal that most entities that would be required to comply with the Rule are most likely already required to comply with the FTC’s Red Flags Rule. Furthermore, the Rule, if adopted, would not contain any new requirements that are not already in the FTC’s final rules, nor would they expand the scope of those rules to include new entities that are not already previously covered by those rules. The SEC believes, however, that because of industry specific guidance and examples given in the Rule proposal, financial services firms may better be able to discern whether the rules apply to them.
The SEC’s Rule would apply to “financial institutions” and “creditors.” The SEC does include investment advisers as a type of entity that may be subject to the Rule. However, the Rule defines the term “financial institution” to include certain banks and credit unions, as well as “any other person that, directly or indirectly, holds a transaction account belonging to a consumer.” While a “transaction account” is defined as “a deposit or account on which the depositor or account holder is permitted to make withdrawals by negotiable or transferable instrument, payment orders of withdrawal, telephone transfers, or other similar items for the purpose of making payments or transfers to third parties or others.”
The SEC specifically recognized that most registered investment advisers are unlikely to hold transaction accounts and thus would not qualify as financial institutions. The SEC is, however, soliciting comment on their proposed definition of “financial institution.” Specifically, the SEC acts if the Rule should omit investment advisers or any other type of entity from the list of entities that may be covered by the Rule.
Regarding the term “creditor” the SEC announced that it will follow the guidance of the FTC’s Red Flags Rules. That legislative history of that definition indicates that it was intended to ensure that business that may “advance funds … or that may bill in arrears for services provided, should not be considered creditors.” The SEC Rule proposal would therefore not include investment advisers because they bill in arrears.
In summary, it does not appear that this new set of Red Flags Rules will impact many investment advisers.