compliance. The new regulation does not contain new requirements, nor
does it expand the scope of the rules to include new entities that were
not already previously covered by the Agencies' card issuer rules.
    The existing costs related to proposed Sec.  162.32 would include
the cost for card issuers to establish policies and procedures that
assess the validity of a change of address notification submitted
shortly before a request for an additional card and, before issuing an
additional or replacement card, either notify the cardholder at the
previous address or through another previously agreed-upon form of
communication, or alternatively assess the validity of the address
change through existing policies and procedures. As discussed in the
PRA analysis, CFTC staff does not expect that any CFTC-regulated
entities would be subject to the requirements of proposed Sec.  162.32.
    The benefits related to adoption of proposed Sec.  162.32, which
already exist in connection with the Agencies' card issuer rules, would
include a reduction in the risk of identity theft for cardholders, and
a reduction in the risk of losses due to fraud for card issuers.
However, it is not practicable for the CFTC to determine with precision
the dollar value associated with the benefits that will inure to the
public from these proposed card issuer rules. As is true of the
Agencies' card issuer rules, the CFTC has designed proposed Sec.
162.32 to provide card issuers significant flexibility in developing
and maintaining a Program that is tailored to the size and complexity
of their business and the nature of their operations.
    Accordingly, as previously discussed, the proposed card issuer
rules should not result in any significant new costs or benefits,
because they generally reflect a statutory transfer of enforcement
authority from the FTC to the CFTC, do not include any significant new
requirements, and do not include new entities that were not previously
covered by the Agencies' rules.
    Section 15(a) Analysis. As stated above, the CFTC is required to
consider costs and benefits of proposed CFTC action in light of (1)
protection of market participants and the public; (2) efficiency,
competitiveness, and financial integrity of futures markets; (3) price
discovery; (4) sound risk management practices; and (5) other public
interest considerations. These proposed rules and guidelines protect
market participants and the public by preventing identity theft, an
illegal act that may be costly to them in both time and money.\130\
Because, however, these rules create no new requirements--rather, as
explained above, the CFTC is adopting rules that reflect requirements
already in place--their cost and benefits have no incremental impact on
the five section 15(a) factors. Customers of CFTC-registrants will
continue to benefit from these proposed rules and guidelines in the
same way they have benefited from the rules as they were administered
by the Agencies.
---------------------------------------------------------------------------

    \130\ See id.
---------------------------------------------------------------------------

3. Questions
     The CFTC requests comment on all aspects of this cost-
benefit analysis, including identification, quantification, and
assessment of any costs and benefits, whether or not discussed in the
above analysis. The CFTC encourages commenters to identify, discuss,
analyze, and supply relevant data regarding any additional costs and
benefits.
     The CFTC requests comment on the accuracy of the cost
estimates in each section of this analysis, and requests that
commenters provide data that may be relevant to these cost estimates,
including quantification.
    In addition, the CFTC seeks estimates and views regarding these
costs and benefits for all affected entities, including small entities,
as well as any other costs or benefits that may result from the
adoption of proposed subpart C to Part 162.
    SEC:
    The SEC is sensitive to the costs and benefits imposed by its
rules. Proposed Regulation S-ID would require financial institutions
and creditors that are subject to the SEC's enforcement authority under
the FCRA \131\ and that offer or maintain covered accounts to develop,
implement, and administer a written identity theft prevention Program.
A financial institution or creditor would have to design its Program to
detect, prevent, and mitigate identity theft in connection with the
opening of a covered account or any existing covered account. In
addition, a financial institution or creditor would have to
appropriately tailor its Program to its size and complexity, and to the
nature and scope of its activities. There are various steps that a
financial institution or creditor would have to take in order to comply
with the requirements under the proposed identity theft red flags
rules, including training staff, providing annual reports to board of
directors, and, when applicable, monitoring the use of third-party
service providers.
---------------------------------------------------------------------------

    \131\ See supra note 19.
---------------------------------------------------------------------------

    Section 615(e)(1)(C) of the FCRA singles out change of address

notifications sent to credit and debit card issuers as a possible
indicator of identity theft, and requires the SEC to prescribe
regulations concerning such notifications. Accordingly, the proposed
card issuer rules in this release set out the duties of card issuers
regarding changes of address. The proposed card issuer rules would
apply only to SEC-regulated entities that issue credit or debit
cards.\132\ The proposed card issuer rules would require a card issuer
to comply with certain address validation procedures in the event that
such issuer receives a notification of a change of address for an
existing account from a cardholder, and within a short period of time
(during at least the first 30 days after it receives such notification)
receives a request for an additional or replacement card for the same
account. The card issuer may not issue the additional or replacement
card unless it complies with those procedures. The procedures include:
(1) Notifying the cardholder of the request either at the cardholder's
former address, or by any other means of communication that the card
issuer and the cardholder have previously agreed to use; or (2)
assessing the validity of the change of address in accordance with
established policies and procedures.
---------------------------------------------------------------------------

    \132\ See proposed Sec.  248.202(a) (defining scope of proposed
rule).
---------------------------------------------------------------------------

    As discussed above, the Dodd-Frank Act shifted enforcement
authority over SEC-regulated entities that are subject to section
615(e) of the FCRA from the FTC to the SEC. Section 615(e) of the FCRA,
as amended by the Dodd-Frank Act, requires that the SEC, jointly with
the Agencies and the CFTC, adopt identity theft red flags rules and
guidelines. To carry out this requirement, the SEC is proposing
Regulation S-ID, which is substantially similar to the identity theft
red flags rules and guidelines adopted by the Agencies in 2007.
    Proposed Regulation S-ID would shift oversight of identity theft
rules and guidelines of SEC-regulated entities from the FTC to the SEC.
These entities should already be in compliance with the FTC's existing
rules and guidelines, which the FTC began enforcing on December 31,
2010. Because proposed Regulation S-ID is substantially similar to
those existing rules and guidelines, these entities should not bear any
new costs in coming into compliance with proposed Regulation S-ID. The
new regulation does not contain new requirements, nor does it expand
the scope of the rules to include new entities that were not already
previously covered by the Agencies' rules. The new regulation does
contain examples and minor language changes designed to help guide
entities under the SEC's jurisdiction in complying with the rules.
    In the analysis for the Paperwork Reduction Act of 1995 (``PRA'')
below, the staff identified certain initial and ongoing hour burdens
and associated time costs related to compliance with proposed
Regulation S-ID.\133\ However, these costs are not new costs, but are
current costs associated with compliance with the Agencies' existing
rules. SEC-regulated entities will incur these hours and costs
regardless of whether the SEC adopts proposed Regulation S-ID. These
hours and costs would be transferred from the Agencies' PRA allotment
to the SEC. No new costs should result from the adoption of proposed
Regulation S-ID.
---------------------------------------------------------------------------

    \133\ Unless otherwise stated, all cost estimates for personnel
time are derived from SIFMA's Management & Professional Earnings in
the Securities Industry 2010, modified to account for an 1800-hour
work-year and multiplied by 5.35 to account for bonuses, firm size,
employee benefits, and overhead.
---------------------------------------------------------------------------

    These existing costs related to Sec.  248.201 of proposed
Regulation S-ID would include, for newly formed SEC-regulated entities,
the incremental one-time cost for financial institutions and creditors
to conduct initial assessments of covered accounts, create a Program,
obtain board approval of the Program, and train staff.\134\ The
existing costs would also include the incremental ongoing cost to
periodically review and update the program, report periodically on the
Program, and conduct periodic assessments of covered accounts.\135\ The
existing costs related to Sec.  248.202 of proposed Regulation S-ID
would include the incremental cost for card issuers to establish
policies and procedures that assess the validity of a change of address
notification submitted shortly before a request for an additional card
and, before issuing an additional or replacement card, either notify
the cardholder at the previous address or through another previously
agreed-upon form of communication, or alternatively assess the validity
of the address change through existing policies and procedures. As
discussed in the PRA analysis, SEC staff does not expect that any SEC-
regulated entities would be subject to the requirements of Sec.
248.202 of proposed Regulation S-ID.
---------------------------------------------------------------------------

    \134\ SEC staff estimates that the incremental one-time burden
of compliance would include 2 hours to conduct initial assessments
of covered accounts, 25 hours to develop and obtain board approval
of a Program, and 4 hours to train staff. SEC staff estimates that,
of the 31 hours incurred, 12 hours would be spent by internal
counsel at an hourly rate of $354, 17 hours would be spent by
administrative assistants at an hourly rate of $66, and 2 hours
would be spent by the board of directors as a whole, at an hourly
rate of $4000, for a total cost of $13,370 per entity for entities
that need to come into compliance with proposed Regulation S-ID.
This estimate is based on the following calculations: $354 x 12
hours = $4248; $66 x 17 = $1,122; $4000 x 2 = $8000; $4248 + $1,122
+ $8000 = $13,370.
    As discussed in the PRA analysis, SEC staff estimates that there
are 1327 SEC-regulated entities that newly form each year and would
be financial institutions or creditors, of which 465 would maintain
covered accounts. See infra note 153 and following text. SEC staff
estimates that 2 hours of internal counsel's time would be spent
conducting an initial assessment of covered accounts and that all
newly formed financial institutions or creditors subject to the
proposed rule (or 1327 entities) would bear this cost for a total
cost of $939,516 based on the following calculation: $354 x 2 =
$708; $708 x 1327 = $939,516. SEC staff estimates that 465 entities
would bear the remaining specified costs for a total cost of
$5,887,830 (465 x $12,662 = $5,887,830).
    \135\ SEC staff estimates that the incremental ongoing burden of
compliance would include 2 hours to conduct periodic assessments of
covered accounts, 2 hours to periodically review and update the
Program, and 4 hours to prepare and present an annual report to the
board, for a total of 8 hours. SEC staff estimates that, of the 8
hours incurred, 7 hours would be spent by internal counsel at an
hourly rate of $354 and 1 hour would be spent by the board of
directors as a whole, at an hourly rate of $4000, for a total hourly
cost of $6478. This estimate is based on the following calculations:
$354 x 7 hours = $2478; $4000 x 1 hour = $4000; $2478 + $4000 =
$6478.
     As discussed in the PRA analysis, SEC staff estimates that 7978
existing SEC-regulated entities would be financial institutions or
creditors under the proposal and 7180 of these entities maintain
covered accounts. See infra note 156 and following text. SEC staff
estimates that 2 hours of internal counsel's time would be spent
conducting periodic assessments of covered accounts and that all
financial institutions or creditors subject to the proposed rule (or
7978 entities) would bear this cost for a total cost of $5,648,424
based on the following calculations: $354 x 2 = $708; $708 x 7978 =
$5,648,424. SEC staff estimates that 7180 entities would bear the
remaining specified ongoing costs for a total cost of $41,428,600
(7180 x $5770 = $41,428,600).
---------------------------------------------------------------------------

    The benefits related to adoption of Regulation S-ID, which already
exist in connection with the Agencies' red flags rules and guidelines,
would include a reduction in the risk of identity theft for investors
(consumers) and cardholders, and a reduction in the risk of losses due
to fraud for financial institutions and creditors. Joint adoption by
the Commissions of identity theft red flags rules in a form that is
substantially similar to the Agencies' identity theft red flags rules
and guidelines might also benefit financial institutions and creditors
because entities regulated by multiple federal agencies could comply
with a single set of standards, which would reduce potential compliance
costs. As is true of the Agencies' rules and guidelines, the SEC has
designed proposed Regulation S-ID to provide financial institutions,
creditors, and card issuers significant flexibility in developing and
maintaining a Program that is tailored to the size and complexity of
their business and the

nature of their operations, as well as in satisfying the address
verification procedures.
    Accordingly, as previously discussed, proposed Regulation S-ID
should not result in any significant new costs or benefits, because it
generally reflects a statutory transfer of enforcement authority from
the FTC to the SEC, does not include any significant new requirements,
and does not include new entities that were not previously covered by
the Agencies' rules.
     The SEC requests comment on all aspects of this cost-
benefit analysis, including identification and assessment of any costs
and benefits not discussed in this analysis. The SEC encourages
commenters to identify, discuss, analyze, and supply relevant data
regarding any additional costs and benefits.
     The SEC requests comment on the accuracy of the cost
estimates in each section of this analysis, and requests that
commenters provide data that may be relevant to these cost estimates.
     In addition, the SEC seeks estimates and views regarding
these costs and benefits for all affected entities, including small
entities, as well as any other costs or benefits that may result from
the adoption of proposed Regulation S-ID.

B. Analysis of Effects on Efficiency, Competition, and Capital
Formation

    Section 3(f) of the Securities Exchange Act and section 2(c) of the
Investment Company Act require the SEC, whenever it engages in
rulemaking and must consider or determine if an action is necessary or
appropriate in the public interest, to consider, in addition to the
protection of investors, whether the action would promote efficiency,
competition, and capital formation. In addition, section 23(a)(2) of
the Exchange Act requires the SEC, when proposing rules under the
Exchange Act, to consider the impact the proposed rules may have upon
competition. Section 23(a)(2) of the Exchange Act prohibits the SEC
from adopting any rule that would impose a burden on competition that
is not necessary or appropriate in furtherance of the purposes of the
Exchange Act.\136\
---------------------------------------------------------------------------

    \136\ See infra Section IV (setting forth statutory authority
under, among other things, the Exchange Act and Investment Company
Act for proposed rules).
---------------------------------------------------------------------------

    As discussed in the cost benefit analysis above, proposed
Regulation S-ID would carry out the requirement in the Dodd-Frank Act
that the SEC adopt rules and guidelines governing identity theft
protections, pursuant to section 615(e) of the FCRA with regard to
entities that are subject to the SEC's jurisdiction. This requirement
was designed to transfer regulatory oversight of identity theft rules
and guidelines of SEC-regulated entities from the FTC to the SEC.
Proposed Regulation S-ID is substantially similar to the identity theft
red flags rules and guidelines adopted by the FTC and other regulatory
agencies in 2007, and does not contain new requirements. The entities
covered by proposed Regulation S-ID should already be in compliance
with existing rules and guidelines, which the FTC began to enforce on
December 31, 2010.
    For the reasons discussed above, proposed Regulation S-ID should
not have an effect on efficiency, competition, or capital formation
because it does not include new requirements and does not include new
entities that were not previously covered by the Agencies' rules.
     The SEC seeks comment on the potential impact of the
proposed rules on efficiency, competition, and capital formation. For
purposes of the Small Business Regulatory Enforcement Fairness Act of
1996 (SBREFA), the SEC also requests information regarding the
potential effect of the proposed rules on the U.S. economy on an annual
basis. Commenters are requested to provide empirical data to support
their views.

C. Paperwork Reduction Act

    CFTC:
    Provisions of proposed Sec. Sec.  162.30 and 162.32 would result in
new collection of information requirements within the meaning of the
PRA. The CFTC, therefore, is submitting this proposal to the Office of
Management and Budget (``OMB'') for review in accordance with 44 U.S.C.
3507(d) and 5 CFR 1320.11. OMB has not yet assigned a control number to
the new collection. The title for this collection of information is
``Part 162 Subpart C--Identity Theft.'' If adopted, responses to this
new collection of information would be mandatory.
1. Information Provided by Reporting Entities/Persons
    Under proposed part 162, subpart C, CFTC regulated entities--which
presently would include approximately 268 CFTC registrants \137\ plus
125 new CFTC registrants pursuant to Title VII of the Dodd-Frank Act
\138\--may be required to design, develop and implement reasonable
policies and procedures to identify relevant red flags, and potentially
notifying cardholders of identity theft risks. In addition, CFTC-
regulated entities would be required to: (i) Collect information and
keep records for the purpose of ensuring that their Programs met
requirements to detect, prevent, and mitigate identity theft in
connection with the opening of a covered account or any existing
covered account; (ii) develop and implement reasonable policies and
procedures to identify, detect and respond to relevant red flags, as
well as periodic reports related to the Program; and (iii) from time to
time, notify cardholders of possible identity theft with respect to
their accounts, as well as assess the validity of those accounts.
---------------------------------------------------------------------------

    \137\ See the NFA's Internet Web site at: http://www.nfa.futures.org/NFA-registration/NFA-membership-and-dues.HTML
for the most up-to-date number of CFTC regulated entities. For the
purposes of the PRA calculation, CFTC staff used the number of
registered FCMs, CTAs, CPOs IBs and RFEDs on the NFA's Internet Web
site as of October 31, 2011. The NFA's site states that there are
3,663 CFTC registrants as of September 30, 2011. Of this total,
there are 111 FCMs, 1,441 IBs, 1,054 CTAs, 1,035 CPOs, and 14 RFEDs.
CFTC staff has observed that approximately 50 percent of all CPOs
are dually registered as CTAs. Based on this observation, CFTC has
determined that the total number of entities is 3,124 (518 CPOs that
are also registered as CTAs). With respect to RFEDs, CFTC staff also
has observed that all entities registering as RFEDs also register as
FCMs.
    Of the total 3,124 entities, all of the FCMs are likely to
qualify as financial institutions or creditors carrying covered
accounts, 10 percent of CTAs and CPOs are likely to qualify as
financial institutions or creditors carrying covered accounts and
none of the IBs are likely to qualify as a financial institution or
creditor carrying covered accounts, for a total of 268 financial
institutions or creditors that would bear the initial one-time
burden of compliance with the CFTC's proposed identity theft rules
and guidelines and proposed card issuer rules.
    \138\ CFTC staff estimates that 125 swap dealers and major swap
participants will register with the CFTC following the issuance of
final rules under the Dodd-Frank Act further defining the terms
``swap dealers'' and ``major swap participants'' and setting forth a
registration regime for these entities. The CFTC estimates the
number of MSPs to be quite small, at six or fewer.
---------------------------------------------------------------------------

    These burden estimates assume that CFTC-regulated entities already
comply with the identity theft red flags rules and guidelines jointly
adopted by the FTC with the Agencies, as of December 31, 2010.
Consequently, these entities may already have in place many of the
customary protections addressing identity theft and changes of address
proposed by these regulations.
    Burden means the total time, effort, or financial resources
expended by persons to generate, maintain, retain, disclose or provide
information to or for a federal agency. Because compliance with rules
and guidelines jointly adopted by the FTC with the Agencies may have
occurred, the CFTC estimates the time and cost burdens of complying
with proposed part 162 to be both one-time and ongoing burdens.
However, any initial or one-time burdens associated with compliance
with proposed part

162 would apply only to newly formed entities, and the ongoing burden
to all CFTC-regulated entities.
i. Initial Burden
    The CFTC estimates that the one-time burden of compliance with
proposed part 162 for its regulated entities with covered accounts
would be: (i) 25 hours to develop and obtain board approval of a
Program, (ii) 4 hours for staff training, and (iii) 2 hours to conduct
an initial assessment of covered accounts, totaling 31 hours. Of the 31
hours, the CFTC estimates that 15 hours would involve internal counsel,
14 hours expended by administrative assistants, and 2 hours by the
board of directors in total, for those newly-regulated entities.
    The CFTC estimates that approximately 702 FCMs, CTAs and CPOs \139\
would need to conduct an initial assessment of covered accounts. As
noted above, the CFTC estimates that approximately 125 newly registered
SDs and MSPs would need to conduct an initial assessment of covered
accounts. The total number of newly registered CFTC registrants would
be 827 entities. Each of these 827 entities would need to conduct an
initial assessment of covered accounts, for a total of 1,654
hours.\140\ Of these 827 entities, CFTC staff estimates that
approximately 179 of these entities may maintain covered accounts.
Accordingly, the CFTC estimates the one-time burden for these 179
entities to be 5,549 hours,\141\ for a total burden among newly
registered entities of 7,203 hours.\142\
---------------------------------------------------------------------------

    \139\ Based on a review of new registrations typically filed
with the CFTC each year, CFTC staff estimates that approximately, 7
FCMs, 225 IBs, 400 CTAs, and 140 CPOs are newly formed each year,
for a total of 772 entities. CFTC staff also has observed that
approximately 50 percent of all CPOs are duly registered as CTAs.
Based on this observation, CFTC has determined that the total number
of newly formed financial institutions and creditors is 702 (772--70
CPOs that are also registered as CTAs). With respect to RFEDs, CFTC
staff has observed that all entities registering as RFEDs also
register as FCMs. Each of these 702 financial institutions or
creditors would bear the initial one-time burden of compliance with
the proposed identity theft rules and guidelines and proposed card
issuer rules.
    Of the total 702 newly formed entities, staff estimates that all
of the FCMs are likely to carry covered accounts, 10 percent of CTAs
and CPOs are likely to carry covered accounts, and none of the IBs
are likely to carry covered accounts, for a total of 54 newly formed
financial institutions or creditors carrying covered accounts that
would be required to conduct an initial one-time burden of
compliance with subpart C or Part 162.
    \140\ This estimate is based on the following calculation: 827
entities x 2 hours = 1,654 hours.
    \141\ This estimate is based on the following calculation: 179
entities x 31 hours = 5,549 hours.
    \142\ This estimate is based on the following calculation: 1,654
hours for all newly registered CFTC registrants + 7,203 hours for
the one-time burden of newly registered entities with covered
accounts.
---------------------------------------------------------------------------

    The CFTC requests comments on these estimates of numbers of persons
affected and the total hours involved.
ii. Ongoing Burden
    The CFTC staff estimates that the ongoing compliance burden
associated with proposed part 162 would include: (i) 2 hours to
periodically review and update the Program, review and preserve
contracts with service providers, and review and preserve any
documentation received from such providers (ii) 4 hours to prepare and
present an annual report to the board, and (iii) 2 hours to conduct
periodic assessments to determine if the entity offers or maintains
covered accounts, for a total of 8 hours. The CFTC staff estimates that
of the 8 hours expended, 7 hours would be spent by internal counsel and
1 hour would be spent by the board of directors as a whole.
    The CFTC estimates that approximately 3,249 persons may maintain
covered accounts, and that they would be required to periodically
review their accounts to determine if they comply with these proposed
rules, for a total of 76,498 hours for these entities.\143\ Of these
3,249 persons, the CFTC estimates that approximately 393 maintain
covered accounts, and thus would need to incur the additional burdens
related to complying with the rule, for a total of 2,358.\144\ The
total ongoing burden for all CFTC registrants is 11,256.\145\
---------------------------------------------------------------------------

    \143\ This estimate is based on the following calculation: 3,249
entities x hours = 6,498 hours.
    \144\ This estimate is based on the following calculation: 393
entities x 6 hours = 2,358 hours.
    \145\ This estimate is based on the following calculation: 6,498
hours + 2,358 hours = 8,856 hours.
---------------------------------------------------------------------------

2. Information Collection Comments
    The CFTC invites the public and other federal agencies to comment
on any aspect of the burdens discussed above. Pursuant to 44 U.S.C.
3506(c)(2)(B), the CFTC solicits comments in order to: (i) Evaluate
whether the proposed collection of information is necessary for the
proper performance of the functions of the CFTC, including whether the
information will have practical utility; (ii) evaluate the accuracy of
the CFTC's estimate of the burden of the proposed collection of
information; (iii) determine whether there are ways to enhance the
quality, utility, and clarity of the information to be collected; and
(iv) minimize the burden of the collection of information on those who
are to respond, including through the use of automated collection
techniques or other forms of information technology.
    Comments may be submitted directly to the Office of Information and
Regulatory Affairs, by fax at<PHONE_NUMBER> or by email at
<EMAIL_ADDRESS>Please provide the CFTC with a copy of
submitted comments so that all comments can be summarized and addressed
in the final rule preamble. Refer to the Addresses section of this
notice of proposed rules and guidelines for comment submission
instructions to the CFTC. A copy of the supporting statements for the
collections of information discussed above may be obtained by visiting
RegInfo.gov. OMB is required to make a decision concerning the
collection of information between 30 and 60 days after publication of
this release. Consequently, a comment to OMB is most assured of being
fully effective if received by OMB (and the CFTC) within 30 days after
publication of this notice of proposed rulemaking.
    SEC:
    Provisions of proposed Sec. Sec.  248.201 and 248.202 would result
in new collection of information requirements within the meaning of the
PRA. The SEC therefore is submitting this proposal to the Office of
Management and Budget (``OMB'') for review in accordance with 44 U.S.C.
3507(d) and 5 CFR 1320.11. OMB has not yet assigned a control number to
the new collection. The title for this collection of information is
``Part 248, Subpart C--Regulation S-ID.'' An agency may not conduct or
sponsor, and a person is not required to respond to, a collection of
information unless it displays a currently valid OMB control number. If
the rules are adopted, responses to the new collection of information
provisions would be mandatory, and the information, when provided to
the Commission in connection with staff examinations or investigations,
would be kept confidential to the extent permitted by law.
1. Description of the Collections
    Under proposed Regulation S-ID, SEC-regulated entities would be
required to develop and implement reasonable policies and procedures to
identify, detect and respond to relevant red flags and, in the case of
entities that issue credit or debit cards, to assess the validity of,
and communicate with cardholders regarding, address changes. Proposed
Sec.  248.201 of Regulation S-ID would include the following
``collections of information'' by SEC-regulated entities that are
financial institutions or creditors if the entity maintains covered
accounts: (1) Creation and periodic updating of a

Program that is approved by the board of directors; (2) periodic staff
reporting on compliance with the identify theft red flags rules and
guidelines, as required to be considered by section VI of the proposed
guidelines; and (3) training of staff to implement the Program.
Proposed Sec.  248.202 of Regulation S-ID would include the following
``collections of information'' by any SEC-regulated entities that are
credit or debit card issuers: (1) Establishment of policies and
procedures that assess the validity of a change of address notification
if a request for an additional card on the account follows soon after
the address change, (2) notification of a cardholder, before issuance
of an additional or replacement card, at the previous address or
through some other previously agreed-upon form of communication, or
alternatively, assessment of the validity of the address change request
through the entity's established policies and procedures.
    SEC staff expects that SEC-regulated entities that would comply
with the collections of information required by proposed Regulation S-
ID should already be fully in compliance with the identity theft red
flags rules and guidelines that the FTC jointly adopted with the
Agencies and began enforcing on December 31, 2010. The requirements of
those rules and guidelines are substantially similar and comparable to
the requirements of proposed Regulation S-ID.\146\
---------------------------------------------------------------------------

    \146\ See 2007 Adopting Release, supra note 10; ``FTC Extends
Enforcement Deadline for Identity Theft Red Flags Rule'' at http://www.ftc.gov/opa/2010/05/redflags.shtm.
---------------------------------------------------------------------------

    In addition, SEC staff understands that most SEC-regulated entities
that are financial institutions or creditors would likely already have
in place many of the protections regarding identity theft and changes
of address that the proposed regulations would require because they are
usual and customary business practices that they engage in to minimize
losses from fraud. Furthermore, SEC staff believes that many of them
are likely to have already effectively implemented most of the proposed
requirements as a result of having to comply (or an affiliate having to
comply) with other, existing regulations and guidance, such as the
Customer Identification Program regulations implementing section 326 of
the USA PATRIOT Act,\147\ the Federal Information Processing Standards
that implement section 501(b) of the Gramm-Leach-Bliley Act
(GLBA),\148\ section 216 of the FACT Act,\149\ and guidance issued by
the Agencies or the Federal Financial Institutions Examination Council
regarding information security, authentication, identity theft, and
response programs.\150\
---------------------------------------------------------------------------

    \147\ 31 U.S.C. 5318(l) (requiring verification of the identity
of persons opening new accounts).
    \148\ 15 U.S.C. 6801.
    \149\ 15 U.S.C. 1681w.
    \150\ See 2007 Adopting Release, supra note 10, at nn. 55-57
(describing applicable regulations and guidance).
---------------------------------------------------------------------------

    As a result, SEC staff estimates of time and cost burdens here
represent the incremental one-time burden of complying with proposed
Regulation S-ID for newly formed SEC-regulated entities, and the
incremental ongoing costs of compliance for all SEC-regulated
entities.\151\ SEC staff estimates also attribute all burdens to
covered entities, which are entities directly subject to the
requirements of the proposed rulemaking. A covered entity that
outsources activities to an affiliate or a third-party service provider
is, in effect, reallocating to that affiliate or service provider the
burden that it would otherwise have carried itself. Under these
circumstances, the burden is, by contract, shifted from the covered
entity to the service provider, but the total amount of burden is not
increased. Thus, affiliate and third-party service provider burdens are
already included in the burden estimates provided for covered entities.
The time and cost estimates made here are based on conversations with
industry representatives and on a review of the estimates made in the
regulatory analyses of the identity theft red flags rules and
guidelines previously issued by the Agencies.
---------------------------------------------------------------------------

    \151\ Based on discussions with industry representatives and a
review of applicable law, SEC staff expects that, of the SEC-
regulated entities that fall within the scope of proposed Regulation
S-ID, most broker-dealers, many investment companies (including
almost all open-end investment companies and employees' securities
companies (``ESCs'')), and some registered investment advisers would
likely qualify as financial institutions or creditors. SEC staff
expects that most other SEC-regulated entities described in the
scope section of proposed Regulation S-ID, such as transfer agents,
NRSROs, SROs, and clearing agencies are unlikely to be financial
institutions or creditors as defined in the proposed rule, and
therefore we do not include these entities in our estimates.
---------------------------------------------------------------------------

2. Proposed Sec.  248.201 (Duties Regarding the Detection, Prevention,
and Mitigation of Identity Theft)
    The collections of information required by proposed Sec.  248.201
would apply to SEC-regulated entities that are financial institutions
or creditors.\152\ As stated above, SEC staff expects that all existing
SEC-regulated entities would already have incurred one-time burdens
associated with compliance with proposed Regulation S-ID because they
should already be in compliance with the substantially identical
requirements of the Agencies' red flags rules and guidelines.
Therefore, any initial or one-time burdens associated with compliance
with Sec.  248.201 of proposed Regulation S-ID would apply only to
newly formed entities. The ongoing burden would apply to all SEC-
regulated entities that are financial institutions or creditors.
---------------------------------------------------------------------------

    \152\ Proposed Sec.  248.201(a).
---------------------------------------------------------------------------

i. Initial Burden
    SEC staff estimates that the incremental one-time burden of
compliance with proposed Sec.  248.201 for SEC-regulated financial
institutions and creditors with covered accounts would be: (i) 25 hours
to develop and obtain board approval of a Program, (ii) 4 hours to
train staff, and (iii) 2 hours to conduct an initial assessment of
covered accounts, for a total of 31 hours. SEC staff estimates that, of
the 31 hours incurred, 12 hours would be spent by internal counsel, 17
hours would be spent by administrative assistants, and 2 hours would be
spent by the board of directors as a whole for entities that need to
come into compliance with proposed Regulation S-ID.
    SEC staff estimates that approximately 517 SEC-regulated financial
institutions and creditors are newly formed each year.\153\ Each of
these 517 entities would need to conduct an initial assessment of
covered accounts, for a total of 1034 hours.\154\ Of these, SEC staff
estimates that approximately 90% (or 465) maintain covered accounts.
Accordingly, SEC staff estimates that the total one-time burden for the
465 entities would be 14,415 hours, and the total one-time burden for
all SEC

regulated entities would be 15,449 hours.\155\
---------------------------------------------------------------------------

    \153\ Based on a review of new registrations typically filed
with the SEC each year, SEC staff estimates that approximately 900
investment advisers, 300 broker dealers, 117 open-end investment
companies and 10 employees' securities companies typically apply for
registration with the SEC or otherwise are newly formed each year,
for a total of 1327 entities that would be financial institutions or
creditors. The staff estimate of 900 investment advisers is made in
light of the recently adopted amendments to rules under the
Investment Advisers Act that carry out requirements of the Dodd-
Frank Act to transfer oversight of certain investment advisers from
the SEC to state regulators and to require certain investment
advisers to private funds to register with the SEC. See Rules
Implementing Amendments to the Investment Advisers Act of 1940,
Investment Advisers Act Release No. 3221 (June 22, 2011) [76 FR
42950 (July 19, 2011)]. Of these, SEC staff estimates that all of
the investment companies and broker-dealers are likely to qualify as
financial institutions or creditors, and 10% (or 90) of investment
advisers are likely to also qualify, for a total of 517 total newly
formed financial institutions or creditors that would bear the
initial one-time burden of compliance with proposed Regulation S-ID.
    \154\ This estimate is based on the following calculation: 517
entities x 2 hours = 1034 hours.
    \155\ These estimates are based on the following calculations:
465 entities x 31 hours = 14,415 hours; 14,415 hours + 1034 hours =
15,449 hours.
---------------------------------------------------------------------------

     The SEC requests comments on these estimates. Is the
estimate that 90% of all financial institutions and creditors maintain
covered accounts correct?
ii. Ongoing Burden
    SEC staff estimates that the incremental ongoing burden of
compliance with proposed Sec.  248.201 would include: (i) 2 hours to
periodically review and update the Program, review and preserve
contracts with service providers, and review and preserve any
documentation received from service providers, (ii) 4 hours to prepare
and present an annual report to the board, and (iii) 2 hours to conduct
periodic assessments to determine if the entity offers or maintains
covered accounts, for a total of 8 hours. SEC staff estimates that of
the 8 hours incurred, 7 hours would be spent by internal counsel and 1
hour would be spent by the board of directors as a whole.
    SEC staff estimates that there are 7978 SEC regulated entities that
are either financial institutions or creditors, and that all of these
would be required to periodically review their accounts to determine if
they offer or maintain covered accounts, for a total of 15,956 hours
for these entities.\156\ Of these 7978 entities, SEC staff estimates
that approximately 90 percent, or 7180, maintain covered accounts, and
thus would need to bear the additional burdens related to complying
with the rule.\157\ Accordingly, SEC staff estimates that the total
ongoing burden for the 7180 entities to be 43,080 hours, and the total
ongoing burden for all SEC-regulated entities as a whole to be 59,036
hours.\158\
---------------------------------------------------------------------------

    \156\ Based on a review of entities that the SEC regulates, SEC
staff estimates that, as of the end of December 2010, there are
approximately 5063 broker-dealers, 1790 active open-end investment
companies and 150 employees' securities companies. In light of
recently adopted amendments to rules under the Investment Advisers
Act that carry out requirements of the Dodd-Frank Act to transfer
oversight of certain investment advisers from the SEC to state
regulators and to require certain investment advisers to private
funds to register with the SEC, SEC staff estimates that, when these
amendments become effective, there will be approximately 9750
investment advisers registered with the SEC. See supra note 153. Of
these, SEC staff estimates that all of the broker-dealers, open-end
investment companies and employees' securities companies are likely
to qualify as financial institutions or creditors, and 10% (or 975)
of investment advisers are likely to qualify, for a total of 7978
total financial institutions or creditors that would bear the
ongoing burden of compliance with proposed Regulation S-ID. The SEC
staff estimates that the other types of entities that are covered by
the scope of the SEC's proposed rule would not be financial
institutions or creditors that maintain covered accounts. See
proposed Sec.  248.201(a). This estimate is based on the following
calculation: (7978 entities x 2 hours = 15,956 hours).
    \157\ If a financial institution or creditor does not maintain
covered accounts, there would be no ongoing annual burden for
purposes of the PRA.
    \158\ These estimates are based on the following calculations:
(7180 entities x 6 hours = 43,080 hours; 43,080 hours + 15,956 hours
= 59,036 hours).
---------------------------------------------------------------------------

     SEC staff requests comments on these estimates.
3. Proposed Sec.  248.202 (Duties of Card Issuers Regarding Changes of
Address)
    The collections of information required by proposed Sec.  248.202
would apply only to SEC-regulated entities that issue credit or debit
cards.\159\ SEC staff understands that SEC-regulated entities generally
do not issue credit or debit cards, but instead partner with other
entities, such as banks, that issue cards on their behalf. These
partner entities, which are not regulated by the SEC, are already
subject to substantially similar change of address obligations pursuant
to the Agencies' identity theft red flags rules and guidelines. In
addition, SEC staff understands that card issuers already assess the
validity of change of address requests and, for the most part, have
automated the process of notifying the cardholder or using other means
to assess the validity of changes of address. Therefore, implementation
of this requirement would pose no further burden.
---------------------------------------------------------------------------

    \159\ Proposed Sec.  248.202(a).
---------------------------------------------------------------------------

    SEC staff does not expect that any SEC-regulated entities would be
subject to the information collection requirements of proposed Sec.
248.202. Accordingly, SEC staff estimates that there will be no hourly
or cost burden for SEC-regulated entities related to proposed Sec.
248.202.\160\
---------------------------------------------------------------------------

    \160\ When the Agencies adopted their red flags rules, they
estimated that it would require approximately 4 hours to develop
policies and procedures to assess the validity of changes of
address, and that there would be no burden associated with notifying
cardholders because all entities already have such a process in
place. See 2007 Adopting Release, supra note 10, at text following
n.57. SEC staff estimates that if any SEC-regulated entities do
issue cards, the burden for complying with proposed Sec.  248.202
would be comparable to the Agencies' estimates.
---------------------------------------------------------------------------

     SEC staff requests comment on this estimate. Are there any
SEC-regulated entities that issue credit or debit cards? If so, what
incremental time or cost burden would be imposed by proposed Sec.
248.202 of Regulation S-ID?
4. Request for Comment
    The SEC requests comment on the accuracy of the estimates provided
in this description of collections of information. Pursuant to 44
U.S.C. 3506(c)(2)(B), the SEC solicits comments in order to: (i)
Evaluate whether the proposed collections of information are necessary
for the proper performance of the functions of the SEC, including
whether the information will have practical utility; (ii) evaluate the
accuracy of the SEC's estimate of the burden of the proposed
collections of information; (iii) determine whether there are ways to
enhance the quality, utility, and clarity of the information to be
collected; and (iv) minimize the burden of the collections of
information on those who are to respond, including through the use of
automated collection techniques or other forms of information
technology.
    Persons wishing to submit comments on the collection of information
requirements of the proposed amendments should direct them to the
Office of Management and Budget, Attention Desk Officer for the
Securities and Exchange Commission, Office of Information and
Regulatory Affairs, Room 10102, New Executive Office Building,
Washington, DC 20503, and should send a copy to Elizabeth M. Murphy,
Secretary, Securities and Exchange Commission, 100 F Street NE.,
Washington, DC 20549-1090, with reference to File No. S7-02-12. OMB is
required to make a decision concerning the collections of information
between 30 and 60 days after publication of this release; therefore a
comment to OMB is best assured of having its full effect if OMB
receives it within 30 days after publication of this release. Requests
for materials submitted to OMB by the SEC with regard to these
collections of information should be in writing, refer to File No. S7-
02-12, and be submitted to the Securities and Exchange Commission,
Office of Investor Education and Advocacy, 100 F Street NE.,
Washington, DC 20549-0213.

D. Regulatory Flexibility Act

    CFTC:
    The Regulatory Flexibility Act (``RFA'') \161\ requires that
federal agencies consider whether the regulations they propose will
have a significant economic impact on a substantial number of small
entities and, if so, provide a regulatory flexibility analysis
respecting the impact.\162\ The regulations proposed by the CFTC shall
affect FCMs, retail foreign exchange dealers, IBs, CTAs, CPOs, swap
dealers, and major swap participants. The CFTC has determined

that the requirements on financial institutions and creditors, and card
issuers set forth in the proposed identity theft red flags rules and
guidelines and the proposed card issuer rules, respectively, will not
have a significant economic impact on a substantial number of small
entities because many of these entities are already complying with the
final rules and guidelines of the Agencies. Moreover, the CFTC believes
that the proposed rules and guidelines include a great deal of
flexibility to assist its regulated entities in complying with such
rules and guidelines.
---------------------------------------------------------------------------

    \161\ See 5 U.S.C. 601 et seq.
    \162\ See 5 U.S.C. 601 et seq.
---------------------------------------------------------------------------

    Notwithstanding this determination, the CFTC previously determined
that FCMs and CPOs are not small entities for the purposes of the
RFA.\163\ Similarly, in another proposed rulemaking promulgated under
the Dodd-Frank Act, the CFTC determined that swap dealers and major
swap participants are not, in fact, ``small entities'' for the purposes
of the RFA.\164\
---------------------------------------------------------------------------

    \163\ See the CFTC's previous determinations for FCMs and CPOs
at 47 FR 18618, 18619 (Apr. 30, 1982).
    \164\ See Confirmation, Portfolio Reconciliation, and Portfolio
Compression Requirements for Swap Dealers and Major Swap
Participants, 75 FR 81519 (Dec. 28, 2010), in which the CFTC
reasoned that swap dealers will be subject to minimum capital and
margin requirements and are expected to comprise the largest global
financial firms. As a result, swap dealers are not likely to be
small entities for the purposes of the RFA. In addition, the CFTC
reasoned that major swap participants, by statutory definition,
maintain substantial positions in swaps or maintain outstanding swap
positions that create substantial counterparty exposure that could
have serious adverse effects on the financial stability of the U.S.
banking system or financial markets. Based on this analysis, the
CFTC concluded that major swap participants are not likely to be
small entities for the purposes of the RFA.
---------------------------------------------------------------------------

    Accordingly, the Chairman, on behalf of the CFTC, hereby certifies
pursuant to 5 U.S.C. 605(b) that the proposed rules and guidelines will
not have a significant impact on a substantial number of small
entities.
     The CFTC invites public comments on its certification.
    SEC:
    The SEC's Initial Regulatory Flexibility Analysis (``IRFA'') has
been prepared in accordance with 5 U.S.C. 603. It relates to the SEC's
proposed identity theft red flags rules and guidelines in proposed
Regulation S-ID under section 615(e)(1)(C) of the FCRA.\165\
---------------------------------------------------------------------------

    \165\ 15 U.S.C. 1681m(e).
---------------------------------------------------------------------------

1. Reasons for, and Objectives of, the Proposed Actions
    The FACT Act, which amended FCRA, was enacted in part to help
prevent the theft of consumer information. The statute contains several
provisions relating to the detection, prevention, and mitigation of
identity theft. Section 1088(a) of the Dodd-Frank Act amended section
615(e) of the FCRA by adding the SEC (and CFTC) to the list of federal
agencies required to prescribe rules related to the detection,
prevention, and mitigation of identity theft. The SEC is proposing
rules to implement the statutory directives in section 615(e) of the
FCRA, which require the SEC to prescribe identity theft regulations
jointly with other agencies.
    Section 615(e) requires the SEC to prescribe regulations that
require financial institutions and creditors to establish policies and
procedures to implement guidelines established by the SEC that address
identity theft with respect to account holders and customers. Section
615(e) also requires the SEC to adopt regulations applicable to credit
and debit card issuers to implement policies and procedures to assess
the validity of change of address requests.
2. Legal Basis
    The SEC is proposing Regulation S-ID under the authority set forth
in 15 U.S.C. 78q, 78q-1, 78o-4, 78o-5, 78w, 80a-30, 80a-37, 80b-4, 80b-
11, 1681m(e), 1681s(b), 1681s-3 and note, 1681w(a)(1), 6801-6809, and
6825; Public Law 111-203, sec. 1088(a)(8), (a)(10), and sec. 1088(b).
3. Small Entities Subject to the Rule
    For purposes of the RFA, an investment company is a small entity if
it, together with other investment companies in the same group of
related investment companies, has net assets of $50 million or less as
of the end of its most recent fiscal year. SEC staff estimates that
approximately 122 investment companies of the 1790 total registered on
Form N-1A meet this definition.\166\
---------------------------------------------------------------------------

    \166\ This information is based on staff analysis of information
from filings on Form N-SAR and from databases compiled by third-
party information providers, including Lipper Inc.
---------------------------------------------------------------------------

    Under SEC rules, for purposes of the Advisers Act and the RFA, an
investment adviser generally is a small entity if it: (i) Has assets
under management having a total value of less than $25 million; (ii)
did not have total assets of $5 million or more on the last day of its
most recent fiscal year; and (iii) does not control, is not controlled
by, and is not under common control with another investment adviser
that has assets under management of $25 million or more, or any person
(other than a natural person) that had total assets of $5 million or
more on the last day of its most recent fiscal year.\167\ Based on
information in filings submitted to the SEC, 570 of the approximately
11,500 investment advisers registered with the SEC are small
entities.\168\
---------------------------------------------------------------------------

    \167\ Rule 0-7(a).
    \168\ This information is based on data from the Investment
Adviser Registration Depository.
---------------------------------------------------------------------------

    For purposes of the RFA, a broker-dealer is a small business if it
had total capital (net worth plus subordinated liabilities) of less
than $500,000 on the date in the prior fiscal year as of which its
audited financial statements were prepared pursuant to rule 17a-5(d) of
the Exchange Act or, if not required to file such statements, a broker-
dealer that had total capital (net worth plus subordinated liabilities)
of less than $500,000 on the last business day of the preceding fiscal
year (or in the time that it has been in business, if shorter) and if
it is not an affiliate of an entity that is not a small business.\169\
SEC staff estimates that approximately 879 broker-dealers meet this
definition.\170\
---------------------------------------------------------------------------

    \169\ 17 CFR 240.0-10.
    \170\ This estimate is based on information provided in FOCUS
Reports filed with the Commission. There are approximately 5063
broker-dealers registered with the Commission.
---------------------------------------------------------------------------

4. Reporting, Recordkeeping, and Other Compliance Requirements
    Section 615(e) of the FCRA, as amended by section 1088 of the Dodd-
Frank Act, requires the SEC to prescribe regulations that require
financial institutions and creditors to establish reasonable policies
and procedures to implement guidelines established by the SEC and other
federal agencies that address identity theft with respect to account
holders and customers. Section 248.201 of proposed Regulation S-ID
would implement this mandate by requiring a covered financial
institution or creditor to create an Identity Theft Prevention Program
that detects, prevents, and mitigates the risk of identity theft
applicable to its accounts.
    Section 615(e) also requires the SEC to adopt regulations
applicable to credit and debit card issuers to implement policies and
procedures to assess the validity of change of address requests.
Section 248.202 of proposed Regulation S-ID would implement this
requirement by requiring credit and debit card issuers to establish
reasonable policies and procedures to assess the validity of a change
of address if it receives notification of a change of address for a
credit or debit card account and within a short period of time
afterwards (within 30 days or more), the issuer receives a

request for an additional or replacement card for the same account.
    Because all SEC-regulated entities, including small entities,
should already be in compliance with the substantially similar red
flags rules and guidelines that the FTC began enforcing on December 31,
2010, proposed Regulation S-ID should not impose new compliance,
recordkeeping, or reporting burdens. If for any reason an SEC-regulated
small entity is not already in compliance with the existing red flags
rules and guidelines issued by the Agencies, the burden of compliance
with proposed Regulation S-ID should be minimal because entities
already engage in various activities to minimize losses due to fraud as
part of their usual and customary business practices. In particular,
the rule will direct many of these entities to consolidate their
existing policies and procedures into a written Program and may require
some additional staff training. Accordingly, the impact of the proposed
requirements would be merely incremental and not significant.
    The SEC has estimated the costs of proposed Regulation S-ID for all
entities (including small entities) in the PRA and cost benefit
analyses included in this release. No new classes of skills would be
required to comply with proposed Regulation S-ID. SEC staff does not
anticipate that small entities would face unique or special burdens
when complying with proposed Regulation S-ID.
5. Duplicative, Overlapping, or Conflicting Federal Rules
    SEC staff has not identified any federal rules that duplicate,
overlap, or conflict with the proposed rule or rule or form amendments.
6. Significant Alternatives
    The Regulatory Flexibility Act directs the SEC to consider
significant alternatives that would accomplish our stated objective,
while minimizing any significant economic impact on small issuers. In
connection with proposed Regulation S-ID, the SEC considered the
following alternatives: (i) The establishment of differing compliance
or reporting requirements or timetables that take into account the
resources available to small entities; (ii) the clarification,
consolidation, or simplification of compliance requirements under the
proposal for small entities; (iii) the use of performance rather than
design standards; and (iv) an exemption from coverage of the proposal,
or any part thereof, for small entities.
    The proposed rules would require financial institutions and
creditors to create an identity theft prevention Program and report to
the board of directors, a committee of the board, or senior management
at least annually on compliance with the regulations. Credit and debit
card issuers would be required to respond to a change of address
request by notifying the cardholder or using other means to assess the
validity of a change of address.
    The standards in proposed Regulation S-ID are flexible, and take
into account a covered entity's size and sophistication, as well as the
costs and benefits of alternative compliance methods. An identity theft
prevention Program under proposed Regulation S-ID would be tailored to
the risk of identity theft in a financial institution or creditor's
covered accounts, thereby permitting small entities whose accounts pose
a low risk of identity theft to avoid much of the costs of compliance.
Because small entities maintain covered accounts that pose a risk of
identity theft for consumers just as larger entities do, we do not
believe that providing an exemption from proposed Regulation S-ID for
small entities would comply with the intent of section 615(e), and
could subject consumers with covered accounts at small entities to a
higher risk of identity theft.
    Pursuant to the mandate of section 615(e) of the FCRA, as amended
by section 1088 of the Dodd-Frank Act, the SEC and the CFTC are
proposing identity theft red flags rules and guidelines jointly, and
they would be substantially similar and comparable to the identity
theft red flags rules and guidelines previously adopted by the
Agencies. Providing a new exemption for small entities, or further
consolidating or simplifying the regulations for small entities could
result in significant differences between the identity theft red flags
rules proposed by the Commissions and the rules adopted by the
Agencies. Because all SEC-regulated entities, including small entities,
should already be in compliance with the substantially similar red
flags rules and guidelines that the FTC began enforcing on December 31,
2010, SEC staff does not expect that small entities would need a
delayed effective or compliance date.
     The SEC seeks comment and information on any need for
alternative compliance methods that, consistent with the statutory
requirements, would reduce the economic impact of the rule on such
small entities, including whether to delay the rule's effective date to
provide additional time for small business compliance.
7. General Request for Comment
    The SEC requests comments regarding this analysis. It requests
comment on the number of small entities that would be subject to the
proposed rules and guidelines and whether the proposed rules and
guidelines would have any effects that have not been discussed. The SEC
requests that commenters describe the nature of any effects on small
entities subject to the rules and provide empirical data to support the
nature and extent of such effects. It also requests comment on the
compliance burdens and how they would affect small entities.

IV. Statutory Authority and Text of Proposed Amendments

    The CFTC is proposing to amend Part 162 under the authority set
forth in sections 1088(a)(8), 1088(a)(10) and 1088(b) of the Dodd-Frank
Act, Public Law 111-203, 124 Stat. 1376 (2010) and; sections 615(e) [15
U.S.C 1681m(e)], 621(b) [15 U.S.C 1681s(b)], 624 [15 U.S.C 1681s-3 and
note], 628 [15 U.S.C. 1681w(a)(1)] of the Fair Credit Reporting Act.
    The SEC is proposing Regulation S-ID under the authority set forth
in Section 1088(a)(8) of the Dodd-Frank Act,\171\ Section 615(e) of the
FCRA,\172\ Sections 17 and 36 of the Exchange Act,\173\ Sections 31 and
38 of the Investment Company Act,\174\ and Sections 204 and 211 of the
Investment Advisers Act.\175\
---------------------------------------------------------------------------

    \171\ Public Law 111-203, Section 1088(a)(8), 124 Stat. 1376
(2010).
    \172\ 15 U.S.C. 1681m(e).
    \173\ 15 U.S.C. 78q and 78mm.
    \174\ 15 U.S.C. 80a-30 and 80a-37.
    \175\ 15 U.S.C. 80b-4 and 80b-11.
---------------------------------------------------------------------------

List of Subjects

17 CFR Part 162

    Cardholders, Card issuers, Commodity pool operators, Commodity
trading advisors, Confidential business information, Consumer reports,
Credit, Creditors, Consumer, Customer, Fair and Accurate Credit
Transactions Act, Fair Credit Reporting Act, Financial institutions,
Futures commission merchants, Gramm-Leach-Bliley Act, Identity theft,
Introducing brokers, Major swap participants, Privacy, Red flags,
Reporting and recordkeeping requirements, Retail foreign exchange
dealers, Self-regulatory organizations, Service provider, Swap dealers.

17 CFR Part 248

    Affiliate marketing, Brokers, Cardholders, Card issuers,
Confidential

business information, Consumer reports, Credit, Creditors, Dealers,
Fair and Accurate Credit Transactions Act, Fair Credit Reporting Act,
Financial institutions, Gramm-Leach-Bliley Act, Identity theft,
Investment advisers, Investment companies, Privacy, Reporting and
recordkeeping requirements, Securities, Security measures, Self-
regulatory organizations, Transfer agents.

Text of Proposed Rules

Commodity Futures Trading Commission

    For the reasons stated above in the preamble, the Commodity Futures
Trading Commission proposes to amend 17 CFR part 162 as follows:

PART 162--PROTECTION OF CONSUMER INFORMATION UNDER THE FAIR CREDIT
REPORTING ACT

    1. The authority citation for part 162 continues to read as
follows:

    Authority:  Sec. 1088, Pub. L. 111-203; 124 Stat. 1376 (2010).

    2. Add subpart C to part 162 read as follows:
Subpart C--Identity Theft Red Flags
Sec.
162.22-162.29 [Reserved]
162.30 Duties regarding the detection, prevention, and mitigation of
identity theft.
162.31 [Reserved]
162.32 Duties of card issuers regarding changes of address.

Subpart C--Identity Theft Red Flags

Sec. Sec.  162.22-162.29  [Reserved]

Sec.  162.30  Duties regarding the detection, prevention, and
mitigation of identity theft.

    (a) Scope of this subpart. This section applies to financial
institutions or creditors that are subject to administrative
enforcement of the FCRA by the Commission pursuant to Sec. 621(b)(1) of
the FCRA, 15 U.S.C. 1681s(b)(1).
    (b) Special definitions for this subpart. For purposes of this
section, and Appendix B, the following definitions apply:
    (1) Account means a continuing relationship established by a person
with a financial institution or creditor to obtain a product or service
for personal, family, household or business purposes. Account includes
an extension of credit, such as the purchase of property or services
involving a deferred payment.
    (2) The term board of directors includes:
    (i) In the case of a branch or agency of a foreign bank, the
managing official in charge of the branch or agency; and
    (ii) In the case of any other creditor that does not have a board
of directors, a designated senior management employee.
    (3) Covered account means:
    (i) An account that a financial institution or creditor offers or
maintains, primarily for personal, family, or household purposes, that
involves or is designed to permit multiple payments or transactions,
such as a margin account; and
    (ii) Any other account that the financial institution or creditor
offers or maintains for which there is a reasonably foreseeable risk to
customers or to the safety and soundness of the financial institution
or creditor from identity theft, including financial, operational,
compliance, reputation, or litigation risks.
    (4) Credit has the same meaning in Section 603(r)(5) of the FCRA,
15 U.S.C. 1681a(r)(5).
    (5) Creditor has the same meaning as in 15 U.S.C. 1681m(e)(4), and
includes any futures commission merchant, retail foreign exchange
dealer, commodity trading advisor, commodity pool operator, introducing
broker, swap dealer, or major swap participant that regularly extends,
renews, or continues credit; regularly arranges for the extension,
renewal, or continuation of credit; or in acting as an assignee of an
original creditor, participates in the decision to extend, renew, or
continue credit.
    (6) Customer means a person that has a covered account with a
financial institution or creditor.
    (7) Financial institution has the same meaning as in 15 U.S.C.
1681a(t) and includes any futures commission merchant, retail foreign
exchange dealer, commodity trading advisor, commodity pool operator,
introducing broker, swap dealer, or major swap participant that
directly or indirectly holds a transaction account belonging to a
consumer.
    (8) Identifying information means any name or number that may be
used, alone or in conjunction with any other information, to identify a
specific person, including any--
    (i) Name, social security number, date of birth, official State or
government issued driver's license or identification number, alien
registration number, government passport number, employer or taxpayer
identification number;
    (ii) Unique biometric data, such as fingerprint, voice print,
retina or iris image, or other unique physical representation;
    (iii) Unique electronic identification number, address, or routing
code; or
    (iv) Telecommunication identifying information or access device (as
defined in 18 U.S.C. 1029(e)).
    (9) Identity theft means a fraud committed or attempted using the
identifying information of another person without authority.
    (10) Red Flag means a pattern, practice, or specific activity that
indicates the possible existence of identity theft.
    (11) Service provider means a person that provides a service
directly to the financial institution or creditor.
    (c) Periodic identification of covered accounts. Each financial
institution or creditor must periodically determine whether it offers
or maintains covered accounts. As a part of this determination, a
financial institution or creditor shall conduct a risk assessment to
determine whether it offers or maintains covered accounts described in
paragraph (b)(3)(ii) of this section, taking into consideration:
    (1) The methods it provides to open its accounts;
    (2) The methods it provides to access its accounts; and
    (3) Its previous experiences with identity theft.
    (d) Establishment of an Identity Theft Prevention Program. (1)
Program requirement. Each financial institution or creditor that offers
or maintains one or more covered accounts must develop and implement a
written Identity Theft Prevention Program that is designed to detect,
prevent, and mitigate identity theft in connection with the opening of
a covered account or any existing covered account. The Identity Theft
Prevention Program must be appropriate to the size and complexity of
the financial institution or creditor and the nature and scope of its
activities.
    (2) Elements of the Identity Theft Prevention Program. The Identity
Theft Prevention Program must include reasonable policies and
procedures to:
    (i) Identify relevant Red Flags for the covered accounts that the
financial institution or creditor offers or maintains, and incorporate
those Red Flags into its Identity Theft Prevention Program;
    (ii) Detect Red Flags that have been incorporated into the Identity
Theft Prevention Program of the financial institution or creditor;
    (iii) Respond appropriately to any Red Flags that are detected
pursuant to paragraph (d)(2)(ii) of this section to prevent and
mitigate identity theft; and
    (iv) Ensure the Identity Theft Prevention Program (including the
Red Flags determined to be relevant) is updated periodically, to
reflect changes in risks to customers and to the safety

and soundness of the financial institution or creditor from identity
theft.
    (e) Administration of the Identity Theft Prevention Program. Each
financial institution or creditor that is required to implement an
Identity Theft Prevention Program must provide for the continued
administration of the Identity Theft Prevention Program and must:
    (1) Obtain approval of the initial written Identity Theft
Prevention Program from either its board of directors or an appropriate
committee of the board of directors;
    (2) Involve the board of directors, an appropriate committee
thereof, or a designated employee at the level of senior management in
the oversight, development, implementation and administration of the
Identity Theft Prevention Program;
    (3) Train staff, as necessary, to effectively implement the
Identity Theft Prevention Program; and
    (4) Exercise appropriate and effective oversight of service
provider arrangements.
    (f) Guidelines. Each financial institution or creditor that is
required to implement an Identity Theft Prevention Program must
consider the guidelines in appendix B of this part and include in its
Identity Theft Prevention Program those guidelines that are
appropriate.

Sec.  162.31  [Reserved]

Sec.  162.32  Duties of card issuers regarding changes of address.

    (a) Scope. This section applies to a person described in Sec.
162.30(a) of this part that issues a debit or credit card (card
issuer).
    (b) Definition of cardholder. For purposes of this section, a
cardholder means a consumer who has been issued a credit or debit card.
    (c) Address validation requirements. A card issuer must establish
and implement reasonable policies and procedures to assess the validity
of a change of address if it receives notification of a change of
address for a consumer's debit or credit card account and, within a
short period of time afterwards (during at least the first 30 days
after it receives such notification), the card issuer receives a
request for an additional or replacement card for the same account.
Under these circumstances, the card issuer may not issue an additional
or replacement card, until, in accordance with its reasonable policies
and procedures and for the purpose of assessing the validity of the
change of address, the card issuer:
    (1)(i) Notifies the cardholder of the request:
    (A) At the cardholder's former address; or
    (B) By any other means of communication that the card issuer and
the cardholder have previously agreed to use; and
    (ii) Provides to the cardholder a reasonable means of promptly
reporting incorrect address changes; or
    (2) Otherwise assesses the validity of the change of address in
accordance with the policies and procedures the card issuer has
established pursuant to Sec.  162.30 of this part.
    (d) Alternative timing of address validation. A card issuer may
satisfy the requirements of paragraph (c) of this section if it
validates an address pursuant to the methods in paragraph (c)(1) or (2)
of this section when it receives an address change notification, before
it receives a request for an additional or replacement card.
    (e) Form of notice. Any written or electronic notice that the card
issuer provides under this paragraph must be clear and conspicuous and
provided separately from its regular correspondence with the
cardholder.
    3. Add Appendix B to part 162 to read as follows:

Appendix B to Part 162--Interagency Guidelines on Identity Theft
Detection, Prevention, and Mitigation

    Section 162.30 of this part requires each financial institution
or creditor that offers or maintains one or more covered accounts,
as defined in Sec.  162.30(b)(3) of this part, to develop and
provide for the continued administration of a written Identity Theft
Prevention Program to detect, prevent, and mitigate identity theft
in connection with the opening of a covered account or any existing
covered account. These guidelines are intended to assist financial
institutions and creditors in the formulation and maintenance of an
Identity Theft Prevention Program that satisfies the requirements of
Sec.  162.30 of this part.

I. The Identity Theft Prevention Program

    In designing its Identity Theft Prevention Program, a financial
institution or creditor may incorporate, as appropriate, its
existing policies, procedures, and other arrangements that control
reasonably foreseeable risks to customers or to the safety and
soundness of the financial institution or creditor from identity
theft.

II. Identifying Relevant Red Flags

    (a) Risk factors. A financial institution or creditor should
consider the following factors in identifying relevant Red Flags for
covered accounts, as appropriate:
    (1) The types of covered accounts it offers or maintains;
    (2) The methods it provides to open its covered accounts;
    (3) The methods it provides to access its covered accounts; and
    (4) Its previous experiences with identity theft.
    (b) Sources of Red Flags. Financial institutions and creditors
should incorporate relevant Red Flags from sources such as:
    (1) Incidents of identity theft that the financial institution
or creditor has experienced;
    (2) Methods of identity theft that the financial institution or
creditor has identified that reflect changes in identity theft
risks; and
    (3) Applicable supervisory guidance.
    (c) Categories of Red Flags. The Identity Theft Prevention
Program should include relevant Red Flags from the following
categories, as appropriate. Examples of Red Flags from each of these
categories are appended as Supplement A to this Appendix B.
    (1) Alerts, notifications, or other warnings received from
consumer reporting agencies or service providers, such as fraud
detection services;
    (2) The presentation of suspicious documents;
    (3) The presentation of suspicious personal identifying
information, such as a suspicious address change;
    (4) The unusual use of, or other suspicious activity related to,
a covered account; and
    (5) Notice from customers, victims of identity theft, law
enforcement authorities, or other persons regarding possible
identity theft in connection with covered accounts held by the
financial institution or creditor.

III. Detecting Red Flags

    The Identity Theft Prevention Program's policies and procedures
should address the detection of Red Flags in connection with the
opening of covered accounts and existing covered accounts, such as
by:
    (a) Obtaining identifying information about, and verifying the
identity of, a person opening a covered account; and
    (b) Authenticating customers, monitoring transactions, and
verifying the validity of change of address requests, in the case of
existing covered accounts.

IV. Preventing and Mitigating Identity Theft

    The Identity Theft Prevention Program's policies and procedures
should provide for appropriate responses to the Red Flags the
financial institution or creditor has detected that are commensurate
with the degree of risk posed. In determining an appropriate
response, a financial institution or creditor should consider
aggravating factors that may heighten the risk of identity theft,
such as a data security incident that results in unauthorized access
to a customer's account records held by the financial institution or
creditor, or third party, or notice that a customer has provided
information related to a covered account held by the financial
institution or creditor to someone fraudulently claiming to
represent the financial institution or creditor or to a fraudulent
Internet Web site. Appropriate responses may include the following:
    (a) Monitoring a covered account for evidence of identity theft;
    (b) Contacting the customer;
    (c) Changing any passwords, security codes, or other security
devices that permit access to a covered account;
    (d) Reopening a covered account with a new account number;

    (e) Not opening a new covered account;
    (f) Closing an existing covered account;
    (g) Not attempting to collect on a covered account or not
selling a covered account to a debt collector;
    (h) Notifying law enforcement; or
    (i) Determining that no response is warranted under the
particular circumstances.

V. Updating the Identity Theft Prevention Program

    Financial institutions and creditors should update the Identity
Theft Prevention Program (including the Red Flags determined to be
relevant) periodically, to reflect changes in risks to customers or
to the safety and soundness of the financial institution or creditor
from identity theft, based on factors such as:
    (a) The experiences of the financial institution or creditor
with identity theft;
    (b) Changes in methods of identity theft;
    (c) Changes in methods to detect, prevent, and mitigate identity
theft;
    (d) Changes in the types of accounts that the financial
institution or creditor offers or maintains; and
    (e) Changes in the business arrangements of the financial
institution or creditor, including mergers, acquisitions, alliances,
joint ventures, and service provider arrangements.

VI. Methods for Administering the Identity Theft Prevention Program

    (a) Oversight of Identity Theft Prevention Program. Oversight by
the board of directors, an appropriate committee of the board, or a
designated senior management employee should include:
    (1) Assigning specific responsibility for the Identity Theft
Prevention Program's implementation;
    (2) Reviewing reports prepared by staff regarding compliance by
the financial institution or creditor with Sec.  162.30 of this
part; and
    (3) Approving material changes to the Identity Theft Prevention
Program as necessary to address changing identity theft risks.
    (b) Reports--(1) In general. Staff of the financial institution
or creditor responsible for development, implementation, and
administration of its Identity Theft Prevention Program should
report to the board of directors, an appropriate committee of the
board, or a designated senior management employee, at least
annually, on compliance by the financial institution or creditor
with Sec.  162.30 of this part.
    (2) Contents of report. The report should address material
matters related to the Identity Theft Prevention Program and
evaluate issues such as: The effectiveness of the policies and
procedures of the financial institution or creditor in addressing
the risk of identity theft in connection with the opening of covered
accounts and with respect to existing covered accounts; service
provider arrangements; significant incidents involving identity
theft and management's response; and recommendations for material
changes to the Identity Theft Prevention Program.
    (c) Oversight of service provider arrangements. Whenever a
financial institution or creditor engages a service provider to
perform an activity in connection with one or more covered accounts
the financial institution or creditor should take steps to ensure
that the activity of the service provider is conducted in accordance
with reasonable policies and procedures designed to detect, prevent,
and mitigate the risk of identity theft. For example, a financial
institution or creditor could require the service provider by
contract to have policies and procedures to detect relevant Red
Flags that may arise in the performance of the service provider's
activities, and either report the Red Flags to the financial
institution or creditor, or to take appropriate steps to prevent or
mitigate identity theft.

VII. Other Applicable Legal Requirements

    Financial institutions and creditors should be mindful of other
related legal requirements that may be applicable, such as:
    (a) For financial institutions and creditors that are subject to
31 U.S.C. 5318(g), filing a Suspicious Activity Report in accordance
with applicable law and regulation;
    (b) Implementing any requirements under 15 U.S.C. 1681c-1(h)
regarding the circumstances under which credit may be extended when
the financial institution or creditor detects a fraud or active duty
alert;
    (c) Implementing any requirements for furnishers of information
to consumer reporting agencies under 15 U.S.C. 1681s-2, for example,
to correct or update inaccurate or incomplete information, and to
not report information that the furnisher has reasonable cause to
believe is inaccurate; and
    (d) Complying with the prohibitions in 15 U.S.C. 1681m on the
sale, transfer, and placement for collection of certain debts
resulting from identity theft.

Supplement A to Appendix B

    In addition to incorporating Red Flags from the sources
recommended in Section II(b) of the Guidelines in Appendix B of this
part, each financial institution or creditor may consider
incorporating into its Identity Theft Prevention Program, whether
singly or in combination, Red Flags from the following illustrative
examples in connection with covered accounts:

Alerts, Notifications or Warnings From a Consumer Reporting Agency

    1. A fraud or active duty alert is included with a consumer
report.
    2. A consumer reporting agency provides a notice of credit
freeze in response to a request for a consumer report.
    3. A consumer reporting agency provides a notice of address
discrepancy, as defined in Sec. 603(f) of the Fair Credit Reporting
Act (15 U.S.C. 1681a(f)).
    4. A consumer report indicates a pattern of activity that is
inconsistent with the history and usual pattern of activity of an
applicant or customer, such as:
    a. A recent and significant increase in the volume of inquiries;
    b. An unusual number of recently established credit
relationships;
    c. A material change in the use of credit, especially with
respect to recently established credit relationships; or
    d. An account that was closed for cause or identified for abuse
of account privileges by a financial institution or creditor.

Suspicious Documents

    5. Documents provided for identification appear to have been
altered or forged.
    6. The photograph or physical description on the identification
is not consistent with the appearance of the applicant or customer
presenting the identification.
    7. Other information on the identification is not consistent
with information provided by the person opening a new covered
account or customer presenting the identification.
    8. Other information on the identification is not consistent
with readily accessible information that is on file with the
financial institution or creditor, such as a signature card or a
recent check.
    9. An application appears to have been altered or forged, or
gives the appearance of having been destroyed and reassembled.

Suspicious Personal Identifying Information

    10. Personal identifying information provided is inconsistent
when compared against external information sources used by the
financial institution or creditor. For example:
    a. The address does not match any address in the consumer
report; or
    b. The Social Security Number (SSN) has not been issued, or is
listed on the Social Security Administration's Death Master File.
    11. Personal identifying information provided by the customer is
not consistent with other personal identifying information provided
by the customer. For example, there is a lack of correlation between
the SSN range and date of birth.
    12. Personal identifying information provided is associated with
known fraudulent activity as indicated by internal or third-party
sources used by the financial institution or creditor. For example:
    a. The address on an application is the same as the address
provided on a fraudulent application; or
    b. The phone number on an application is the same as the number
provided on a fraudulent application.
    13. Personal identifying information provided is of a type
commonly associated with fraudulent activity as indicated by
internal or third-party sources used by the financial institution or
creditor. For example:
    a. The address on an application is fictitious, a mail drop, or
a prison; or
    b. The phone number is invalid, or is associated with a pager or
answering service.
    14. The SSN provided is the same as that submitted by other
persons opening an account or other customers.
    15. The address or telephone number provided is the same as or
similar to the address or telephone number submitted by an unusually
large number of other persons opening accounts or by other
customers.
    16. The person opening the covered account or the customer fails
to provide all required personal identifying information on an
application or in response to notification that the application is
incomplete.
    17. Personal identifying information provided is not consistent
with personal identifying information that is on file with the
financial institution or creditor.

    18. For financial institutions or creditors that use challenge
questions, the person opening the covered account or the customer
cannot provide authenticating information beyond that which
generally would be available from a wallet or consumer report.

Unusual Use of, or Suspicious Activity Related to, the Covered Account

    19. Shortly following the notice of a change of address for a
covered account, the institution or creditor receives a request for
a new, additional, or replacement means of accessing the account or
for the addition of an authorized user on the account.
    20. A new revolving credit account is used in a manner commonly
associated with known patterns of fraud. For example:
    a. The majority of available credit is used for cash advances or
merchandise that is easily convertible to cash (e.g., electronics
equipment or jewelry); or
    b. The customer fails to make the first payment or makes an
initial payment but no subsequent payments.
    21. A covered account is used in a manner that is not consistent
with established patterns of activity on the account. There is, for
example:
    a. Nonpayment when there is no history of late or missed
payments;
    b. A material increase in the use of available credit;
    c. A material change in purchasing or spending patterns;
    d. A material change in electronic fund transfer patterns in
connection with a deposit account; or
    e. A material change in telephone call patterns in connection
with a cellular phone account.
    22. A covered account that has been inactive for a reasonably
lengthy period of time is used (taking into consideration the type
of account, the expected pattern of usage and other relevant
factors).
    23. Mail sent to the customer is returned repeatedly as
undeliverable although transactions continue to be conducted in
connection with the customer's covered account.
    24. The financial institution or creditor is notified that the
customer is not receiving paper account statements.
    25. The financial institution or creditor is notified of
unauthorized charges or transactions in connection with a customer's
covered account.

Notice From Customers, Victims of Identity Theft, Law Enforcement
Authorities, or Other Persons Regarding Possible Identity Theft in
Connection With Covered Accounts Held by the Financial Institution or
Creditor

    26. The financial institution or creditor is notified by a
customer, a victim of identity theft, a law enforcement authority,
or any other person that it has opened a fraudulent account for a
person engaged in identity theft.

Securities and Exchange Commission

    For the reasons stated above in the preamble, the Securities and
Exchange Commission proposes to amend 17 CFR part 248 as follows:

PART 248--REGULATIONS S-P, S-AM, AND S-ID

    4. The authority citation for part 248 is revised to read as
follows:

    Authority:  15 U.S.C. 78q, 78q-1, 78o-4, 78o-5, 78w, 80a-30,
80a-37, 80b-4, 80b-11, 1681m(e), 1681s(b), 1681s-3 and note,
1681w(a)(1), 6801-6809, and 6825; Pub. L. 111-203, sec. 1088(a)(8),
(a)(10), and sec. 1088(b).

    5. Revise the heading for part 248 to read as set forth above.
    6. Add subpart C to part 248 to read as follows:
Subpart C--Regulation S-ID: Identity Theft Red Flags
Sec.
248.201 Duties regarding the detection, prevention, and mitigation
of identity theft.
248.202 Duties of card issuers regarding changes of address.
Appendix A to Subpart C of Part 248--Interagency Guidelines on
Identity Theft Detection, Prevention, and Mitigation

Subpart C--Regulation S-ID: Identity Theft Red Flags

Sec.  248.201  Duties regarding the detection, prevention, and
mitigation of identity theft.

    (a) Scope. This section applies to a financial institution or
creditor, as defined in the Fair Credit Reporting Act (15 U.S.C. 1681),
that is:
    (1) A broker, dealer or any other person that is registered or
required to be registered under the Securities Exchange Act of 1934;
    (2) An investment company that is registered or required to be
registered under the Investment Company Act of 1940, that has elected
to be regulated as a business development company under that Act, or
that operates as an employees' securities company under that Act; or
    (3) An investment adviser that is registered or required to be
registered under the Investment Advisers Act of 1940.
    (b) Definitions. For purposes of this subpart, and Appendix A of
this subpart, the following definitions apply:
    (1) Account means a continuing relationship established by a person
with a financial institution or creditor to obtain a product or service
for personal, family, household or business purposes. Account includes
a brokerage account, a mutual fund account (i.e., an account with an
open-end investment company), and an investment advisory account.
    (2) The term board of directors includes:
    (i) In the case of a branch or agency of a non U.S. based financial
institution or creditor, the managing official of that branch or
agency; and
    (ii) In the case of a financial institution or creditor that does
not have a board of directors, a designated employee at the level of
senior management.
    (3) Covered account means:
    (i) An account that a financial institution or creditor offers or
maintains, primarily for personal, family, or household purposes, that
involves or is designed to permit multiple payments or transactions,
such as a brokerage account with a broker-dealer or an account
maintained by a mutual fund (or its agent) that permits wire transfers
or other payments to third parties; and
    (ii) Any other account that the financial institution or creditor
offers or maintains for which there is a reasonably foreseeable risk to
customers or to the safety and soundness of the financial institution
or creditor from identity theft, including financial, operational,
compliance, reputation, or litigation risks.
    (4) Credit has the same meaning as in 15 U.S.C. 1681a(r)(5).
    (5) Creditor has the same meaning as in 15 U.S.C. 1681m(e)(4), and
includes lenders such as brokers or dealers offering margin accounts,
securities lending services, and short selling services.
    (6) Customer means a person that has a covered account with a
financial institution or creditor.
    (7) Financial institution has the same meaning as in 15 U.S.C.
1681a(t).
    (8) Identifying information means any name or number that may be
used, alone or in conjunction with any other information, to identify a
specific person, including any--
    (i) Name, social security number, date of birth, official State or
government issued driver's license or identification number, alien
registration number, government passport number, employer or taxpayer
identification number;
    (ii) Unique biometric data, such as fingerprint, voice print,
retina or iris image, or other unique physical representation;
    (iii) Unique electronic identification number, address, or routing
code; or
    (iv) Telecommunication identifying information or access device (as
defined in 18 U.S.C. 1029(e)).
    (9) Identity theft means a fraud committed or attempted using the
identifying information of another person without authority.
    (10) Red Flag means a pattern, practice, or specific activity that
indicates the possible existence of identity theft.

    (11) Service provider means a person that provides a service
directly to the financial institution or creditor.
    (12) Other definitions.
    (i) Broker has the same meaning as in section 3(a)(4) of the
Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(4)).
    (ii) Commission means the Securities and Exchange Commission.
    (iii) Dealer has the same meaning as in section 3(a)(5) of the
Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(5)).
    (iv) Investment adviser has the same meaning as in section
202(a)(11) of the Investment Advisers Act of 1940 (15 U.S.C. 80b-
2(a)(11)).
    (v) Investment company has the same meaning as in section 3 of the
Investment Company Act of 1940 (15 U.S.C. 80a-3), and includes a
separate series of the investment company.
    (vi) Other terms not defined in this subpart have the same meaning
as in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
    (c) Periodic Identification of Covered Accounts. Each financial
institution or creditor must periodically determine whether it offers
or maintains covered accounts. As a part of this determination, a
financial institution or creditor must conduct a risk assessment to
determine whether it offers or maintains covered accounts described in
paragraph (b)(3)(ii) of this section, taking into consideration:
    (1) The methods it provides to open its accounts;
    (2) The methods it provides to access its accounts; and
    (3) Its previous experiences with identity theft.
    (d) Establishment of an Identity Theft Prevention Program--(1)
Program requirement. Each financial institution or creditor that offers
or maintains one or more covered accounts must develop and implement a
written Identity Theft Prevention Program (Program) that is designed to
detect, prevent, and mitigate identity theft in connection with the
opening of a covered account or any existing covered account. The
Program must be appropriate to the size and complexity of the financial
institution or creditor and the nature and scope of its activities.
    (2) Elements of the Program. The Program must include reasonable
policies and procedures to:
    (i) Identify relevant Red Flags for the covered accounts that the
financial institution or creditor offers or maintains, and incorporate
those Red Flags into its Program;
    (ii) Detect Red Flags that have been incorporated into the Program
of the financial institution or creditor;
    (iii) Respond appropriately to any Red Flags that are detected
pursuant to paragraph (d)(2)(ii) of this section to prevent and
mitigate identity theft; and
    (iv) Ensure the Program (including the Red Flags determined to be
relevant) is updated periodically, to reflect changes in risks to
customers and to the safety and soundness of the financial institution
or creditor from identity theft.
    (e) Administration of the Program. Each financial institution or
creditor that is required to implement a Program must provide for the
continued administration of the Program and must:
    (1) Obtain approval of the initial written Program from either its
board of directors or an appropriate committee of the board of
directors;
    (2) Involve the board of directors, an appropriate committee
thereof, or a designated employee at the level of senior management in
the oversight, development, implementation and administration of the
Program;
    (3) Train staff, as necessary, to effectively implement the
Program; and
    (4) Exercise appropriate and effective oversight of service
provider arrangements.
    (f) Guidelines. Each financial institution or creditor that is
required to implement a Program must consider the guidelines in
Appendix A to this subpart and include in its Program those guidelines
that are appropriate.

Sec.  248.202  Duties of card issuers regarding changes of address.

    (a) Scope. This section applies to a person described in Sec.
248.201(a) that issues a credit or debit card (card issuer).
    (b) Definitions. For purposes of this section:
    (1) Cardholder means a consumer who has been issued a credit card
or debit card as defined in 15 U.S.C. 1681a(r).
    (2) Clear and conspicuous means reasonably understandable and
designed to call attention to the nature and significance of the
information presented.
    (3) Other terms not defined in this subpart have the same meaning
as in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
    (c) Address validation requirements. A card issuer must establish
and implement reasonable written policies and procedures to assess the
validity of a change of address if it receives notification of a change
of address for a consumer's debit or credit card account and, within a
short period of time afterwards (during at least the first 30 days
after it receives such notification), the card issuer receives a
request for an additional or replacement card for the same account.
Under these circumstances, the card issuer may not issue an additional
or replacement card, until, in accordance with its reasonable policies
and procedures and for the purpose of assessing the validity of the
change of address, the card issuer:
    (1) (i) Notifies the cardholder of the request:
    (A) At the cardholder's former address; or
    (B) By any other means of communication that the card issuer and
the cardholder have previously agreed to use; and
    (ii) Provides to the cardholder a reasonable means of promptly
reporting incorrect address changes; or
    (2) Otherwise assesses the validity of the change of address in
accordance with the policies and procedures the card issuer has
established pursuant to Sec.  248.201 of this part.
    (d) Alternative timing of address validation. A card issuer may
satisfy the requirements of paragraph (c) of this section if it
validates an address pursuant to the methods in paragraph (c)(1) or
(c)(2) of this section when it receives an address change notification,
before it receives a request for an additional or replacement card.
    (e) Form of notice. Any written or electronic notice that the card
issuer provides under this paragraph must be clear and conspicuous and
be provided separately from its regular correspondence with the
cardholder.

Appendix A to Subpart C of Part 248--Interagency Guidelines on Identity
Theft Detection, Prevention, and Mitigation

    Section 248.201 of this part requires each financial institution
and creditor that offers or maintains one or more covered accounts,
as defined in Sec.  248.201(b)(3) of this part, to develop and
provide for the continued administration of a written Program to
detect, prevent, and mitigate identity theft in connection with the
opening of a covered account or any existing covered account. These
guidelines are intended to assist financial institutions and
creditors in the formulation and maintenance of a Program that
satisfies the requirements of Sec.  248.201 of this part.

I. The Program

    In designing its Program, a financial institution or creditor
may incorporate, as appropriate, its existing policies, procedures,
and other arrangements that control reasonably foreseeable risks to
customers or to the safety and soundness of the financial
institution or creditor from identity theft.

II. Identifying Relevant Red Flags

    (a) Risk Factors. A financial institution or creditor should
consider the following factors in identifying relevant Red Flags for
covered accounts, as appropriate:
    (1) The types of covered accounts it offers or maintains;
    (2) The methods it provides to open its covered accounts;
    (3) The methods it provides to access its covered accounts; and
    (4) Its previous experiences with identity theft.
    (b) Sources of Red Flags. Financial institutions and creditors
should incorporate relevant Red Flags from sources such as:
    (1) Incidents of identity theft that the financial institution
or creditor has experienced;
    (2) Methods of identity theft that the financial institution or
creditor has identified that reflect changes in identity theft
risks; and
    (3) Applicable regulatory guidance.
    (c) Categories of Red Flags. The Program should include relevant
Red Flags from the following categories, as appropriate. Examples of
Red Flags from each of these categories are appended as Supplement A
to this Appendix A.
    (1) Alerts, notifications, or other warnings received from
consumer reporting agencies or service providers, such as fraud
detection services;
    (2) The presentation of suspicious documents;
    (3) The presentation of suspicious personal identifying
information, such as a suspicious address change;
    (4) The unusual use of, or other suspicious activity related to,
a covered account; and
    (5) Notice from customers, victims of identity theft, law
enforcement authorities, or other persons regarding possible
identity theft in connection with covered accounts held by the
financial institution or creditor.

III. Detecting Red Flags

    The Program's policies and procedures should address the
detection of Red Flags in connection with the opening of covered
accounts and existing covered accounts, such as by:
    (a) Obtaining identifying information about, and verifying the
identity of, a person opening a covered account, for example, using
the policies and procedures regarding identification and
verification set forth in the Customer Identification Program rules
implementing 31 U.S.C. 5318(l) (31 CFR 1023.220 (broker-dealers) and
1024.220 (mutual funds)); and
    (b) Authenticating customers, monitoring transactions, and
verifying the validity of change of address requests, in the case of
existing covered accounts.

IV. Preventing and Mitigating Identity Theft

    The Program's policies and procedures should provide for
appropriate responses to the Red Flags the financial institution or
creditor has detected that are commensurate with the degree of risk
posed. In determining an appropriate response, a financial
institution or creditor should consider aggravating factors that may
heighten the risk of identity theft, such as a data security
incident that results in unauthorized access to a customer's account
records held by the financial institution, creditor, or third party,
or notice that a customer has provided information related to a
covered account held by the financial institution or creditor to
someone fraudulently claiming to represent the financial institution
or creditor or to a fraudulent Web site. Appropriate responses may
include the following:
    (a) Monitoring a covered account for evidence of identity theft;
    (b) Contacting the customer;
    (c) Changing any passwords, security codes, or other security
devices that permit access to a covered account;
    (d) Reopening a covered account with a new account number;
    (e) Not opening a new covered account;
    (f) Closing an existing covered account;
    (g) Not attempting to collect on a covered account or not
selling a covered account to a debt collector;
    (h) Notifying law enforcement; or
    (i) Determining that no response is warranted under the
particular circumstances.

V. Updating the Program

    Financial institutions and creditors should update the Program
(including the Red Flags determined to be relevant) periodically, to
reflect changes in risks to customers or to the safety and soundness
of the financial institution or creditor from identity theft, based
on factors such as:
    (a) The experiences of the financial institution or creditor
with identity theft;
    (b) Changes in methods of identity theft;
    (c) Changes in methods to detect, prevent, and mitigate identity
theft;
    (d) Changes in the types of accounts that the financial
institution or creditor offers or maintains; and
    (e) Changes in the business arrangements of the financial
institution or creditor, including mergers, acquisitions, alliances,
joint ventures, and service provider arrangements.

VI. Methods for Administering the Program

    (a) Oversight of Program. Oversight by the board of directors,
an appropriate committee of the board, or a designated employee at
the level of senior management should include:
    (1) Assigning specific responsibility for the Program's
implementation;
    (2) Reviewing reports prepared by staff regarding compliance by
the financial institution or creditor with Sec.  248.201 of this
part; and
    (3) Approving material changes to the Program as necessary to
address changing identity theft risks.
    (b) Reports--(1) In general. Staff of the financial institution
or creditor responsible for development, implementation, and
administration of its Program should report to the board of
directors, an appropriate committee of the board, or a designated
employee at the level of senior management, at least annually, on
compliance by the financial institution or creditor with Sec.
248.201 of this part.
    (2) Contents of report. The report should address material
matters related to the Program and evaluate issues such as: The
effectiveness of the policies and procedures of the financial
institution or creditor in addressing the risk of identity theft in
connection with the opening of covered accounts and with respect to
existing covered accounts; service provider arrangements;
significant incidents involving identity theft and management's
response; and recommendations for material changes to the Program.
    (c) Oversight of service provider arrangements. Whenever a
financial institution or creditor engages a service provider to
perform an activity in connection with one or more covered accounts
the financial institution or creditor should take steps to ensure
that the activity of the service provider is conducted in accordance
with reasonable policies and procedures designed to detect, prevent,
and mitigate the risk of identity theft. For example, a financial
institution or creditor could require the service provider by
contract to have policies and procedures to detect relevant Red
Flags that may arise in the performance of the service provider's
activities, and either report the Red Flags to the financial
institution or creditor, or to take appropriate steps to prevent or
mitigate identity theft.

VII. Other Applicable Legal Requirements

    Financial institutions and creditors should be mindful of other
related legal requirements that may be applicable, such as:
    (a) For financial institutions and creditors that are subject to
31 U.S.C. 5318(g), filing a Suspicious Activity Report in accordance
with applicable law and regulation;
    (b) Implementing any requirements under 15 U.S.C. 1681c-1(h)
regarding the circumstances under which credit may be extended when
the financial institution or creditor detects a fraud or active duty
alert;
    (c) Implementing any requirements for furnishers of information
to consumer reporting agencies under 15 U.S.C. 1681s-2, for example,
to correct or update inaccurate or incomplete information, and to
not report information that the furnisher has reasonable cause to
believe is inaccurate; and
    (d) Complying with the prohibitions in 15 U.S.C. 1681m on the
sale, transfer, and placement for collection of certain debts
resulting from identity theft.

Supplement A to Appendix A

    In addition to incorporating Red Flags from the sources
recommended in section II.b. of the Guidelines in Appendix A to this
subpart, each financial institution or creditor may consider
incorporating into its Program, whether singly or in combination,
Red Flags from the following illustrative examples in connection
with covered accounts:

Alerts, Notifications or Warnings From a Consumer Reporting Agency

    1. A fraud or active duty alert is included with a consumer
report.
    2. A consumer reporting agency provides a notice of credit
freeze in response to a request for a consumer report.
    3. A consumer reporting agency provides a notice of address
discrepancy, as referenced in Sec. 605(h) of the Fair Credit
Reporting Act (15 U.S.C. 1681c(h)).
    4. A consumer report indicates a pattern of activity that is
inconsistent with the history

and usual pattern of activity of an applicant or customer, such as:
    a. A recent and significant increase in the volume of inquiries;
    b. An unusual number of recently established credit
relationships;
    c. A material change in the use of credit, especially with
respect to recently established credit relationships; or
    d. An account that was closed for cause or identified for abuse
of account privileges by a financial institution or creditor.

Suspicious Documents

    5. Documents provided for identification appear to have been
altered or forged.
    6. The photograph or physical description on the identification
is not consistent with the appearance of the applicant or customer
presenting the identification.
    7. Other information on the identification is not consistent
with information provided by the person opening a new covered
account or customer presenting the identification.
    8. Other information on the identification is not consistent
with readily accessible information that is on file with the
financial institution or creditor, such as a signature card or a
recent check.
    9. An application appears to have been altered or forged, or
gives the appearance of having been destroyed and reassembled.

Suspicious Personal Identifying Information

    10. Personal identifying information provided is inconsistent
when compared against external information sources used by the
financial institution or creditor. For example:
    a. The address does not match any address in the consumer
report; or
    b. The Social Security Number (SSN) has not been issued, or is
listed on the Social Security Administration's Death Master File.
    11. Personal identifying information provided by the customer is
not consistent with other personal identifying information provided
by the customer. For example, there is a lack of correlation between
the SSN range and date of birth.
    12. Personal identifying information provided is associated with
known fraudulent activity as indicated by internal or third-party
sources used by the financial institution or creditor. For example:
    a. The address on an application is the same as the address
provided on a fraudulent application; or
    b. The phone number on an application is the same as the number
provided on a fraudulent application.
    13. Personal identifying information provided is of a type
commonly associated with fraudulent activity as indicated by
internal or third-party sources used by the financial institution or
creditor. For example:
    a. The address on an application is fictitious, a mail drop, or
a prison; or
    b. The phone number is invalid, or is associated with a pager or
answering service.
    14. The SSN provided is the same as that submitted by other
persons opening an account or other customers.
    15. The address or telephone number provided is the same as or
similar to the address or telephone number submitted by an unusually
large number of other persons opening accounts or by other
customers.
    16. The person opening the covered account or the customer fails
to provide all required personal identifying information on an
application or in response to notification that the application is
incomplete.
    17. Personal identifying information provided is not consistent
with personal identifying information that is on file with the
financial institution or creditor.
    18. For financial institutions and creditors that use challenge
questions, the person opening the covered account or the customer
cannot provide authenticating information beyond that which
generally would be available from a wallet or consumer report.

Unusual Use of, or Suspicious Activity Related to, the Covered Account

    19. Shortly following the notice of a change of address for a
covered account, the institution or creditor receives a request for
a new, additional, or replacement means of accessing the account or
for the addition of an authorized user on the account.
    20. A covered account is used in a manner that is not consistent
with established patterns of activity on the account. There is, for
example:
    a. Nonpayment when there is no history of late or missed
payments;
    b. A material increase in the use of available credit;
    c. A material change in purchasing or spending patterns; or
    d. A material change in electronic fund transfer patterns in
connection with a deposit account.
    21. A covered account that has been inactive for a reasonably
lengthy period of time is used (taking into consideration the type
of account, the expected pattern of usage and other relevant
factors).
    22. Mail sent to the customer is returned repeatedly as
undeliverable although transactions continue to be conducted in
connection with the customer's covered account.
    23. The financial institution or creditor is notified that the
customer is not receiving paper account statements.
    24. The financial institution or creditor is notified of
unauthorized charges or transactions in connection with a customer's
covered account.

Notice From Customers, Victims of Identity Theft, Law Enforcement
Authorities, or Other Persons Regarding Possible Identity Theft in
Connection With Covered Accounts Held by the Financial Institution or
Creditor

    25. The financial institution or creditor is notified by a
customer, a victim of identity theft, a law enforcement authority,
or any other person that it has opened a fraudulent account for a
person engaged in identity theft.

    Dated: February 28, 2012.

    By the Commodity Futures Trading Commission.
David A. Stawick,
Secretary of the Commodity Futures Trading Commission.

    Dated: February 28, 2012.

    By the Securities and Exchange Commission.
Elizabeth M. Murphy,
Secretary of the Securities and Exchange Commission.

[FR Doc. 2012-5157 Filed 3-5-12; 8:45 am]
BILLING CODE 6351-01-P; 8011-01-P