ABA Banking Journal - July 2008 - (Page 50)

COMPLIANCE CLINIC of potential identity theft: replacement cards and address discrepancies. • Requesting replacement cards is an extremely common identity theft technique. The new rules require credit and debit card issuers to establish and implement policies and procedures to manage the request for replacing or issuing a new card after receiving a change of address notification: they must verify address changes. In addition to following procedures documented in their identity theft program to assess validity of an address change, they must attempt to contact the cardholder at the previous address and provide means to report an erroneous address change. • Address discrepancies are another important indicator. The new rules require that a user of credit reports, when notified by the credit reporting agency that an address discrepancy exists, must have reasonable policies and procedures to be sure that the credit report is truly related to the individual. If the user cannot obtain a “reasonable belief” that the consumer report relates to the consumer, they should not use the report. compliance could result in civil penalties and regulatory fines. And although specific penalties are not yet clear, the risk of being held liable if an identity theft occurs should be more than enough to press most organizations into action. Whether the bank determines to work this internally, with outside consultants, or a blend of the two approaches, a general plan for implementation will ensure readiness for Nov. 1. The following section outlines those steps that need urgent attention. Ensuring red flag compliance The new rules are very broad, in many cases overlapping with existing practices that financial institutions should already have in place, either in response to other regulatory actions or simply to protect themselves and their customers. Key to implementing these new requirements will be engaging the appropriate stakeholders. Compliance requires buy-in from the highest levels, as well as cooperation from legal and compliance functions, fraud specialists, and the information technology group. Clearly regulators consider identity theft a critical issue: full compliance with these new regulations is required a mere 11 months after they were finalized. Non- 1. 2. 3. 4. 5. 6. ASAP to-do list and timeframe Designate senior management in charge of the Program and stakeholders, including information technology, compliance, legal and fraud professionals. Meet to introduce the project and its urgency and perform the following: Conduct a risk assessment and identify covered accounts. Evaluate the role of service providers and other third parties. Review procedures for opening and accessing covered accounts. Create a consolidated short list of red flags to monitor and identify risk for new and existing covered accounts. Brainstorm ways to detect these flags within current procedures. Identify any new procedures that need to be developed, where current procedures won’t detect incidents. Assign subteams to develop these procedures. Be sure to include IT experts in these sub-teams. Draft the red flags identity theft program Obtain approval of the initial written program from either the board of directors or appropriate senior management. July–August: Update affected business forms and documents. Beta test the new program. September: Incorporate results from the beta test into the program and documents as necessary. Develop training materials. October: Roll-out the program in phases and train staff. November 1: Activate the program, administer it, and comply. BJ ABA help available at www.aba.com ABA offers its member a new, free guide to this regulation: ABAWorks On Fraud: Identity Theft Red Flags Regulation. Go to http://www.aba.com/About+ABA/ abatoolboxes.htm 50 JULY 2008/ABA BANKING JOURNAL Subscribe at www.ababj.com http://www.conetrix.com http://www.aba.com http://www.aba.com/About ABA/abatoolboxes.htm http://www.aba.com/About ABA/abatoolboxes.htm http://www.ababj.com

Table of Contents Feed for the Digital Edition of ABA Banking Journal - July 2008

ABA Banking Journal - July 2008 Contents Editor’s Column Searching for New Paradigms at BIS Snapshot: C&I Asset Quality 100th Anniversary: Then & Now BofA "Event Concept" Wins Awards, and Customers ABA Resources ABA Chairman’s Position M&A: Beat Today's Market Blues Pass the Aspirin Cover Story: Workout Time Correspondent Banking: No Longer Just a Handshake Business Getting IT Right By Thinking It Through Webnotes Are You "Red Flag" Ready? Mailbox Banker’s Mart To Advertise/Index of Advertisers The Economy

ABA Banking Journal - July 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.