House and Senate Enact Amendment of FCRA, Limit Scope of Red Flags Rule
The Blog of Legal Times is reporting that late on December 7, 2010 the House of Representatives passed a bill on a voice vote that amends the definition of "creditor" in the Fair and Accurate Credit Reporting Act (FCRA) and, as a result, dramatically limits the scope of the Red Flags Rule. The House bill is identical to the legislation enacted by the Senate last week. We previously covered in detail on our blog both the House bill and the Senate bill.
The legislation has the effect of largely limiting the applicability of the Red Flags Rule to financial institutions and entities commonly understood to be "creditors". It will generally exclude from the Rule's scope organizations whose "credit" activities are limited to providing a product or service and allowing customers to pay for the product or service at a later time. The legislation leaves open the possibility that the FTC would bring various types of creditors within the scope of the Rule through rulemaking. However, it sets a procedural threshold for expanding the scope of the Rule and appears to require the determination to be specific to the type of creditor.
“When I think of the word ‘creditor,’ dentists, accounting firms and law firms do not come to mind,” said Rep. John Adler (D-N.J.), speaking on the House floor.
The legislation limits the definition of "creditor" under the FCRA to entities that:
- obtain or use consumer reports, directly or indirectly, in connection with a credit transaction;
- furnish information to consumer reporting agencies (see 15 U.S.C. 1681s-2) in connection with a credit transaction; or
- advance funds to or on behalf of a person (based on the person's obligation to repay the funds or repayable from property pledged by or on behalf of the person).
More importantly, the amendment specifically excludes from the definition of "creditor" entities that advance funds "to or on behalf of a person for expenses incidental to a service provided by the creditor to that person." This exclusion means that entities that both provide a product or service and allow customers to pay for the product or service at a later time would not be subject to the Red Flags Rule, provided such entities do not engage in the activities enumerated in bullets (1) or (2) above.
The FTC will begin enforcing the Red Flags Rule on December 31, 2010. By this deadline, financial institutions and creditors subject to the FTC's jurisdiction must have an identity prevention program in place to the extent they are required to do so by the Rule.