E9-10009. Fair Credit Reporting Affiliate Marketing Regulations; Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003

AGENCIES:

Office of the Comptroller of the Currency, Treasury (OCC); Board of Governors of the Federal Reserve System (Board); Federal Deposit Insurance Corporation (FDIC); Office of Thrift Supervision, Treasury (OTS); National Credit Union Administration (NCUA); and Federal Trade Commission (Commission).

ACTION:

Final rules; technical corrections.

SUMMARY:

The OCC, Board, FDIC, OTS and NCUA published in the Federal Register final rules to implement the affiliate marketing provisions of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act) on November 7, 2007. The Commission published its final affiliate marketing rule on October 30, 2007. The OCC, Board, FDIC, OTS, NCUA and the Commission (Agencies) published in the Federal Register final rules and guidelines to implement the identity theft red flags and address discrepancy provisions of the FACT Act on November 9, 2007. The technical corrections included in this Federal Register document revise one of the affiliate marketing model forms and the instructions to the model forms to correct inadvertent omissions and conform the model forms and the instructions to the affiliate marketing rules, and correct minor errors in the identity theft red flags and address discrepancy rules and guidelines. The substantive requirements of the affiliate marketing and the identity theft red flags and address discrepancy rules are unchanged.

DATES:

These final rules are effective May 14, 2009, except for the amendments in instructions 4, 10, 15, 20, 26, and 34 relating to appendices C to 12 CFR parts 41, 222, 334, 571, 717 and 16 CFR part 698, respectively, which are effective January 1, 2010.

FOR FURTHER INFORMATION CONTACT:

OCC: Jon Mitchell, Attorney, Legislative and Regulatory Activities Division, [phone], Office of the Comptroller of the Currency, 250 E Street, SW., Washington, DC 20219.

Board: Amy E. Burke, Senior Attorney, or Jelena McWilliams, Attorney, Division of Consumer and Community Affairs, [phone] or [phone]; or Kara Handzlik, Attorney, Legal Division, [phone], Board of Governors of the Federal Reserve System, 20th and C Streets, NW., Washington, DC 20551. For users of a Telecommunications Device for the Deaf (TDD) only, contact [phone].

FDIC: Richard M. Schwartz, Counsel, Legal Division, [phone]; Jeffrey M. Kopchik, Senior Policy Analyst, [phone], or Samuel Frumkin, Senior Policy Analyst, [phone], Division of Supervision and Consumer Protection, Federal Deposit Insurance Corporation, 550 17th Street, NW., Washington, DC 20429.

OTS: Suzanne McQueen, Consumer Regulations Analyst, Compliance and Consumer Protection Division, [phone]; April Breslaw, Director, Consumer Regulations, [phone]; or Richard Bennett, Senior Compliance Counsel, Regulations and Legislation Division, [phone], Office of Thrift Supervision, 1700 G Street, NW., Washington, DC 20552.

NCUA: Linda Dent, Attorney, or Regina Metz, Attorney, Office of General Counsel, 703-518-6540, National Credit Union Administration, 1775 Duke Street, Alexandria, VA 22314-3428.

Commission: Anthony Rodriguez (Affiliate Marketing Rule) or Cora Han (Identity Theft Red Flags Rules), Attorneys, Division of Privacy and Identity Protection, Bureau of Consumer Protection, [phone], Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580.

SUPPLEMENTARY INFORMATION:

Technical Corrections to Affiliate Marketing Final Rules

This final rule includes technical corrections to the affiliate marketing rules (72 FR 61424 and 72 FR 62910) that conform the model notices and instructions to the model notices to the requirements of the affiliate marketing rules. The first technical correction revises current Model Form C-5, one of several optional safe harbor forms provided in the Agencies' regulations, to include language about the duration of a consumer's opt-out. Pursuant to §_.23(a)(1)(v) of the affiliate marketing rules, an affiliate marketing opt-out notice must disclose accurately “[t]hat the consumer's election will apply for the specified period of time stated in the notice and, if applicable, that the consumer will be allowed to renew the election once that period expires.” ^[1] Model Form C-5 is the model form that can be used by a person to provide a voluntary opt-out from all marketing by that person and its affiliates. The version of Model Form C-5 promulgated in the fall of 2007 does not include any information about the duration of the opt-out. By contrast, Model Forms C-1 and C-2 include model language that explains the duration of the consumer's opt-out choice.

In order to ensure that the content of the model form is consistent with the requirements of the regulation, the Agencies are inserting bracketed language into Model Form C-5 that a person may use to disclose the duration of the opt-out period. The new language is based on the assumption that persons providing to consumers a broader right to opt out will not limit the duration of the opt-out period and will allow any voluntary “no-marketing” opt-out to remain in effect until the consumer changes his or her choice. If that is not the case, then alternate language accurately describing the duration of the opt-out period must be substituted for the new bracketed language in the revised Model Form C-5.

The version of Model Form C-5 promulgated in the fall of 2007 is being renumbered as Model Form C-6. To give industry adequate time to revise their model forms, the safe harbor for Model Form C-6 will remain in effect until January 1, 2010.

The second technical correction involves joint relationships. Section_.23(a)(2) of the affiliate marketing rules permits a single opt-out notice to be provided to joint consumers and specifies that the opt-out notice must disclose how an opt-out direction by a joint consumer will be treated. The model forms and instructions to the model forms currently are silent on joint relationships.

In order to ensure that the instructions are consistent with the requirements of the regulation, the Agencies are inserting an additional provision into the instructions for acceptable changes to the model forms clarifying that a person may add to the model forms a disclosure regarding the treatment of opt-outs by joint consumers to comply with the requirements of §_.23(a)(2). Where the notice pertains to a joint account, the person must include such language under §_.23(a)(2). Where the notice pertains to an account that is not a joint account, the person may, but is not required to, include language on joint accounts. A statement about joint accounts in an opt-out notice must be clear, conspicuous, and concise, and must accurately reflect the institution's policy regarding the treatment of opt-outs by joint consumers. For example, where the notice pertains to a joint account and the opt-out will apply to everyone on the account, the statement may provide that, for joint accounts, the opt-out will apply to everyone on the account.

Technical Corrections to Identity Theft Red Flags and Address Discrepancies Final Rules

The technical corrections to the identity theft red flags and address discrepancy rules included in this final rule clarify that address discrepancy notices are provided only by the nationwide CRAs described in section 603(p) of the FCRA (15 U.S.C. 1681a(p)). These corrections to §_.82 conform the address discrepancy rules to the statute.^[2]

This final rule also corrects four minor typographical errors in the final rules and supplement to the guidelines implementing section 114 of the FACT Act (72 FR 63718).

This final rule also corrects a minor error in the scope section of the Board's final rules regarding identity theft red flags. The Board's correction to § 222.90(a) clarifies that operating subsidiaries of member banks of the Federal Reserve System (other than national banks) that are functionally regulated within the meaning of section 5(c)(5) of the Bank Holding Company Act, as amended (12 U.S.C. 1844(c)(5)) are not covered by the Board's rule.

This final rule places section 681.1 of the Commission's final rule into its own separate part of the CFR, part 641, in order to clarify that it pertains to the duties of users of consumer reports regarding address discrepancies. Current sections 681.2 and 681.3, which pertain to identity theft, are reordered as sections 681.1 and 681.2 respectively, and references to these sections in the appendices are corrected as necessary.

The final rule further revises a caption of the NCUA's final rule to clarify which section pertains to the duties of card issuers regarding changes of address.

Basis for the Corrections

The Agencies are issuing these technical corrections as final rules. Under the Administrative Procedure Act, 5 U.S.C. 551, et seq., publication of a notice of proposed rulemaking is not required for interpretative rules, general statements of policy, or rules of agency organization, procedure, or practice, or when an agency for good cause finds (and incorporates the finding and a brief statement of reasons in the rules issued) that notice and public procedures are impracticable, unnecessary, or contrary to the public interest. In addition, a rule may be made effective less than thirty days from publication when an agency finds good cause for such action. 5 U.S.C. 553(b)(A)-(B) and (d)(3). The Agencies find that a notice of proposed rulemaking is not required. First, many of the revisions are interpretative in that they indicate how substantive requirements of the rules apply. In addition, notice is unnecessary because the technical corrections do not change or modify the substantive requirements of the provisions amended. Further, the Agencies find good cause for an immediate effective date because it is unnecessary and contrary to the public interest to delay the effectiveness of those revisions.

With respect to the affiliate marketing rule, the corrections do not establish new regulatory requirements. They merely clarify, through revisions to the model forms and instructions to the model forms, how persons can meet the requirements of the final rules. The Agencies unintentionally omitted the clarifications to the model form and instructions to the model forms and find that it would be potentially misleading, and therefore contrary to the public interest, to delay issuance of the revised model form and instructions to the model forms that conform to the rule.

The Agencies recognize that industry may be relying on the safe harbor provided by the version of Model Form C-5 promulgated in the fall of 2007. See 72 FR 62910. In order to allow persons subject to the rules adequate time to revise applicable opt-out forms to conform to the revised Model Form C-5, the safe harbor for Model Form C-5 promulgated in the fall of 2007, which is being renumbered as Model Form C-6, will remain in effect until January 1, 2010. Use of the revised Model Form C-5 published today complies with the requirements of the rule effective immediately. Thus, until January 1, 2010, the safe harbor is available for a person that uses either form. On and after January 1, 2010, the safe harbor is available only for use of revised Model Form C-5.

Because the corrections to the final rules and supplement to the guidelines implementing section 114 of the FACT Act are typographical in nature, or simply clarify the rule by conforming it to the statute, the Agencies find that it is unnecessary to publish a notice of proposed rulemaking or to delay the effective date of the corrections. Furthermore, the Board finds that it is unnecessary to publish a notice of proposed rulemaking to include a clarification that was unintentionally omitted from the scope section of the Board's final rules regarding identity theft red flags. The addition of language specifying the types of operating subsidiaries that are covered by the Board's rules provides more precise clarification in the regulation of the scope of the Board's statutory enforcement authority of the rule. 15 U.S.C. 1681s. In addition, the FTC finds that it is unnecessary to publish a notice of proposed rulemaking regarding its placing of section 681.1 of the Commission's final rule into a separate part of the CFR, part 641, for purposes of clarifying that this section pertains to the duties of users of consumer reports regarding address discrepancies. The clarification does not change the text or scope of the regulation.

Further, section 302 of the Riegle Community Development and Regulatory Improvement Act of 1994 provides that federal banking agency regulations that impose additional reporting, disclosure, or other new requirements may not take effect before the first day of the quarter following publication, unless the agency determines, for good cause published with the regulation, that the regulation should become effective before such time. 12 U.S.C. 4802. For the same reasons as already discussed, the OCC, Board, FDIC, and OTS find good cause for an immediate effective date on grounds that it is unnecessary and contrary to the public interest to delay the effectiveness of those revisions.

Regulatory Analysis

Paperwork Reduction Act

In accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3506; 5 CFR 1320 Appendix A.1), the Agencies have reviewed the final rules. The rules contain no collections of information pursuant to the Paperwork Reduction Act.

Executive Order 12866

The OCC and OTS have determined that their respective portions of the final rules are not significant regulatory actions under Executive Order 12866.

Regulatory Flexibility Act

The Regulatory Flexibility Act (RFA) does not apply to a rulemaking where a general notice of proposed rulemaking is not required. 5 U.S.C. 603 and 604. As noted previously, the Agencies have determined that it is unnecessary to publish a notice of proposed rulemaking for these final rules. Accordingly, the RFA's requirements relating to an initial and final regulatory flexibility analysis do not apply.

Unfunded Mandates Reform Act of 1995

Section 202 of the Unfunded Mandates Reform Act of 1995, Public Law 104-4 (UMRA), requires that an agency prepare a budgetary impact statement before promulgating a rule that includes a Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector of $100 million or more (adjusted annually for inflation) in any one year. The inflation adjusted threshold is $133 million or more. If a budgetary impact statement is required, section 205 of the UMRA also requires an agency to identify and consider a reasonable number of regulatory alternatives before promulgating a rule. The OCC and OTS have each determined that their respective portions of these final rules will not result in expenditures by State, local, and tribal governments, in the aggregate, or by the private sector, of $133 million or more in any one year. Accordingly, these final rules are not subject to section 202 of the UMRA.

Executive Order 13132

The OCC and OTS have each determined that their respective portions of these final rules do not have any Federalism implications as required by Executive Order 13132.

Executive Order 13132 encourages independent regulatory agencies to consider the impact of their actions on state and local interests. NCUA voluntarily complies with the Executive Order and has determined that the final rules do not have federalism implications for purposes of the Executive Order.

NCUA: Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA)

The SBREFA does not apply to a rulemaking where a final regulatory flexibility analysis under section 604 of title 5, United States Code is not required. 5 U.S.C. 601 note. As noted above, the Agencies have determined the requirements for a final regulatory flexibility analysis do not apply. Accordingly, no SBREFA reporting requirement is required.

NCUA: The Treasury and General Government Appropriations Act, 1999—Assessment of Federal Regulations and Policies on Families

NCUA has determined that this rule would not affect family well-being within the meaning of section 654 of the Treasury and General Government Appropriations Act, 1999, Pub. L. 105-277, 112 Stat. 2681 (1998).

List of Subjects

12 CFR Part 41

• Banks
• Banking
• Consumer protection
• National banks
• Reporting and recordkeeping requirements

12 CFR Part 222

• Banks
• Banking
• Consumer protection
• Fair Credit Reporting Act
• Holding companies
• Privacy
• Reporting and recordkeeping requirements
• State member banks

12 CFR Part 334

• Administrative practice and procedure
• Bank deposit insurance
• Banks
• Banking
• Reporting and recordkeeping requirements
• Safety and soundness

12 CFR Part 571

• Consumer protection
• Credit
• Fair Credit Reporting Act
• Privacy
• Reporting and recordkeeping requirements
• Savings associations

12 CFR Part 717

• Consumer protection
• Credit unions
• Fair credit reporting
• Privacy
• Reporting and recordkeeping requirements

16 CFR Part 641

• Consumer reports
• Users of consumer reports
• Consumer reporting agencies
• Information furnishers

16 CFR Part 681

• Fair Credit Reporting Act
• Consumer reports
• Consumer reporting agencies
• Credit
• Creditors
• Information furnishers
• Identity theft
• Trade practices

16 CFR Part 698

• Consumer reports
• Consumer reporting agencies
• Credit
• Fair Credit Reporting Act
• Trade practices

Title 12

Department of the Treasury

Office of the Comptroller of the Currency

For the reasons set forth in the preamble, 12 CFR part 41 is amended as follows:

PART 41—FAIR CREDIT REPORTING

1. The authority citation for part 41 continues to read as follows:

Authority: 12 U.S.C. 1 et seq., 24 (Seventh), 93a, 481, 484, and 1818; 15 U.S.C. 1681a, 1681b, 1681c, 1681m, 1681s, 1681s-3, 1681t, 1681w, 6801, and 6805; Sec. 214, Public Law 108-159, 117 Stat. 1952.

§ 41.82

[Amended]

2. Section 41.82 is amended by:

a. Adding in paragraph (a) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”;

b. Adding in paragraph (b) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”;

c. Removing in paragraph (c)(2)(i)(A) the phrase “Customer Information Program” and adding in its place the phrase “Customer Identification Program”;

d. Adding in paragraph (d)(1) introductory text after the second occurrence of the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”; and

e. Adding in paragraph (d)(3) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”.

3. Appendix C to Part 41 is amended by:

a. Redesignating Model Form C-5 as Model Form C-6; and

b. Adding new paragraph b.10 and new Model Form C-5 to read as follows:

Appendix C to Part 41—Model Forms for Opt-Out Notices

* * * * *

b. * * *

10. Adding disclosures regarding the treatment of opt-outs by joint consumers to comply with § 41.23(a)(2) of this part.

* * * * *

C-5—Model Form for Voluntary “No Marketing” Notice

Your Choice To Stop Marketing

• [Name of Affiliate] is providing this notice.
• You may choose to stop all marketing from us and our affiliates.
• [Your choice to stop marketing from us and our affiliates will apply until you tell us to change your choice.]

To stop all marketing, contact us [include all that apply]:

• By telephone: 1-877-###-####
• On the Web: www..com
• By mail: Check the box and complete the form below, and send the form to:

[Company name]

[Company address]

_Do not market to me.

* * * * *

Appendix C to Part 41 [Amended]

4. Effective January 1, 2010, remove newly redesignated Model Form C-6.

Appendix J to Part 41, Supplement A [Amended]

5. Appendix J to Part 41, Supplement A, is amended by:

a. Removing in paragraph 15 the phrase “account number” and adding in its place the word “address”;

b. Removing in paragraph 15 the phrase “other customers” and adding in its place the phrase “by other customers”; and

c. Removing in paragraph 20 introductory text the phrase “patterns of fraud patterns” and adding in its place the phrase “patterns of fraud”.

Board of Governors of the Federal Reserve System

For the reasons set forth in the preamble, 12 CFR part 222 is amended as follows:

PART 222—FAIR CREDIT REPORTING (REGULATION V)

6. The authority citation for part 222 continues to read as follows:

Authority: 15 U.S.C. 1681a, 1681b, 1681c, 1681m, 1681s, 1681s-2, 1681s-3, 1681t, and 1681w; Secs. 3 and 214, Pub. L. 108-159, 117 Stat. 1952.

§ 222.82

[Amended]

7. Section 222.82 is amended by:

a. Adding in paragraph (a) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”;

b. Adding in paragraph (b) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”;

c. Removing in paragraph (c)(2)(i)(A) the phrase “Customer Information Program” and adding in its place the phrase “Customer Identification Program”;

d. Adding in paragraph (d)(1) introductory text after the second occurrence of the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”; and

e. Adding in paragraph (d)(3) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”.

§ 222.90

[Amended]

8. Section 222.90(a) is amended by adding after the phrase “and their respective operating subsidiaries” the phrase “that are not functionally regulated within the meaning of section 5(c)(5) of the Bank Holding Company Act, as amended ( 12 U.S.C. 1844(c)(5))”.

9. Appendix C to Part 222 is amended by:

a. Redesignating Model Form C-5 as Model Form C-6; and

b. Adding new paragraph b.10 and new Model Form C-5 to read as follows:

Appendix C to Part 222—Model Forms for Opt-Out Notices

b. * * *

10. Adding disclosures regarding the treatment of opt-outs by joint consumers to comply with § 222.23(a)(2) of this part.

* * * * *

C-5—Model Form for Voluntary “No Marketing” Notice

Your Choice To Stop Marketing

• [Name of Affiliate] is providing this notice.
• You may choose to stop all marketing from us and our affiliates.
• [Your choice to stop marketing from us and our affiliates will apply until you tell us to change your choice.]

To stop all marketing, contact us [include all that apply]:

• By telephone: 1-877-###-####
• On the Web: www..com
• By mail: Check the box and complete the form below, and send the form to:

[Company name]

[Company address]

_Do not market to me.

* * * * *

Appendix C to Part 222 [Amended]

10. Effective January 1, 2010, remove newly redesignated Model Form C-6.

Appendix J to Part 222, Supplement A [Amended]

11. Appendix J to Part 222, Supplement A, is amended by:

a. Removing in paragraph 15 the phrase “account number” and adding in its place the word “address”;

b. Removing in paragraph 15 the phrase “other customers” and adding in its place the phrase “by other customers”; and

c. Removing in paragraph 20 the phrase “patterns of fraud patterns” and adding in its place the phrase “patterns of fraud”

Federal Deposit Insurance Corporation

For the reasons set forth in the preamble, 12 CFR part 334 is amended as follows:

PART 334—FAIR CREDIT REPORTING

12. The authority citation for part 334 continues to read as follows:

Authority: 12 U.S.C. 1818, 1819 (Tenth) and 1831p-1; 15 U.S.C. 1681a, 1681b, 1681c, 1681m, 1681s, 1681s-3, 1681t, 1681w, 6801 and 6805, Public Law 108-159, 117 Stat. 1952.

§ 334.82

[Amended]

13. Section 334.82 is amended by:

a. Adding in paragraph (a) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”;

b. Adding in paragraph (b) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”;

c. Removing in paragraph (c)(2)(i)(A) the phrase “Customer Information Program” and adding in its place the phrase “Customer Identification Program”;

d. Adding in paragraph (d)(1) introductory text after the second occurrence of the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”; and

e. Adding in paragraph (d)(3) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”.

14. Appendix C to Part 334 is amended by:

a. Redesignating Model Form C-5 as Model Form C-6; and

b. Adding new paragraph b.10 and new Model Form C-5 to read as follows:

Appendix C to Part 334—Model Forms for Opt-Out Notices

* * * * *

b.* * *

10. Adding disclosures regarding the treatment of opt-outs by joint consumers to comply with § 334.23(a)(2) of this part.

* * * * *

C-5—Model Form for Voluntary “No Marketing” Notice

Your Choice To Stop Marketing

• [Name of Affiliate] is providing this notice.
• You may choose to stop all marketing from us and our affiliates.
• [Your choice to stop marketing from us and our affiliates will apply until you tell us to change your choice.]

To stop all marketing, contact us [include all that apply]:

• By telephone: 1-877-###-####
• On the Web: www..com
• By mail: Check the box and complete the form below, and send the form to:

[Company name]

[Company address]

_Do not market to me.

* * * * *

Appendix C to Part 334 [Amended]

15. Effective January 1, 2010, remove newly redesignated Model Form C-6.

Appendix J to Part 334, Supplement A [Amended]

16. Appendix J to Part 334, Supplement A, is amended by:

a. Removing in paragraph 15 the phrase “account number” and adding in its place the word “address”;

b. Removing in paragraph 15 the phrase “other customers” and adding in its place the phrase “by other customers”; and

c. Removing in paragraph 20 the phrase “patterns of fraud patterns” and adding in its place the phrase “patterns of fraud”.

Department of the Treasury

Office of Thrift Supervision

For the reasons set forth in the preamble, 12 CFR part 571 is amended as follows:

PART 571—FAIR CREDIT REPORTING

17. The authority citation for part 571 continues to read as follows:

Authority: 12 U.S.C. 1462a, 1463, 1464, 1467a, 1828, 1831p-1, and 1881-1884; 15 U.S.C. 1681b, 1681c, 1681m, 1681s, 1681s-1, 1681t and 1681w; 15 U.S.C. 6801 and 6805; Sec. 214 Pub. L. 108-159, 117 Stat. 1952.

§ 571.82

[Amended]

18. Section 571.82 is amended by:

a. Adding in paragraph (a) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”;

b. Adding in paragraph (b) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”;

c. Removing in paragraph (c)(2)(i)(A) the phrase “Customer Information Program” and adding in its place the phrase “Customer Identification Program”;

d. Adding in paragraph (d)(1) introductory text after the second occurrence of the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”; and

e. Adding in paragraph (d)(3) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”.

19. Appendix C to Part 571 is amended by:

a. Redesignating Model Form C-5 as Model Form C-6; and

b. Adding new paragraph b.10 and new Model Form C-5 to read as follows:

Appendix C to Part 571—Model Forms for Opt-Out Notices

* * * * *

b.* * *

10. Adding disclosures regarding the treatment of opt-outs by joint consumers to comply with § 571.23(a)(2) of this part.

* * * * *

C-5—Model Form for Voluntary “No Marketing” Notice

Your Choice To Stop Marketing

• [Name of Affiliate] is providing this notice.
• You may choose to stop all marketing from us and our affiliates.
• [Your choice to stop marketing from us and our affiliates will apply until you tell us to change your choice.]

To stop all marketing, contact us [include all that apply]:

• By telephone: 1-877-###-####
• On the Web: www.-.com
• By mail: Check the box and complete the form below, and send the form to:

[Company name]

[Company address]

_Do not market to me.

* * * * *

Appendix C to Part 571 [Amended]

20. Effective January 1, 2010, remove newly redesignated Model Form C-6.

Appendix J to Part 571, Supplement A [Amended]

21. Appendix J to Part 571, Supplement A, is amended by:

a. Removing in paragraph 15 the phrase “account number” and adding in its place the word “address”;

b. Removing in paragraph 15 the phrase “other customers” and adding in its place the phrase “by other customers”; and

c. Removing in paragraph 20 the phrase “patterns of fraud patterns” and adding in its place the phrase “patterns of fraud”.

National Credit Union Administration

For the reasons set forth in the preamble, 12 CFR part 717 is amended as follows:

PART 717—FAIR CREDIT REPORTING

22. The authority citation for part 717 continues to read as follows:

Authority: 12 U.S.C. 1751 et seq.; 15 U.S.C. 1681a, 1681b, 1681c, 1681m, 1681s, 1681s-1, 1681t, 1681w, 6801 and 6805, Public Law 108-159, 117 Stat. 1952.

Subpart I—Duties of Users of Consumer Reports Regarding Address Discrepancies and Records Disposal

§ 717.82

[Amended]

23. Section 717.82 is amended by:

a. Adding in paragraph (a) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”;

b. Adding in paragraph (b) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”;

c. Removing in paragraph (c)(2)(i)(A) the phrase “Customer Information Program” and adding in its place the phrase “Customer Identification Program”;

d. Adding in paragraph (d)(1) introductory text after the second occurrence of the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”; and

e. Adding in paragraph (d)(3) after the phrase “consumer reporting agency” the phrase “described in 15 U.S.C. 1681a(p)”.

24. The heading for § 717.91 is revised to read as follows:

§ 717.91

Duties of card issuers regarding changes of address.

* * * * *

25. Appendix C to Part 717 is amended by:

a. Redesignating Model Form C-5 as Model Form C-6; and

b. Adding new paragraph b.10 and new Model Form C-5 to read as follows:

Appendix C to Part 717—Model Forms for Opt-Out Notices

* * * * *

b. * * *

10. Adding disclosures regarding the treatment of opt-outs by joint consumers to comply with § 717.23(a)(2) of this part.

* * * * *

C-5—Model Form for Voluntary “No Marketing” Notice

Your Choice To Stop Marketing

• [Name of Affiliate] is providing this notice.
• You may choose to stop all marketing from us and our affiliates.
• [Your choice to stop marketing from us and our affiliates will apply until you tell us to change your choice.]

To stop all marketing, contact us [include all that apply]:

• By telephone: 1-877-###-####
• On the Web: www..com
• By mail: Check the box and complete the form below, and send the form to:

[Company name]

[Company address]

_Do not market to me.

* * * * *

Appendix C to Part 717 [Amended]

26. Effective January 1, 2010, remove newly redesignated Model Form C-6.

Appendix J to Part 717, Supplement A [Amended]

27. Appendix J to Part 717, Supplement A, is amended by:

a. Removing in paragraph 15 the phrase “account number” and adding in its place the word “address”;

b. Removing in paragraph 15 the phrase “other members” and adding in its place the phrase “by other members”; and

c. Removing in paragraph 20 the phrase “patterns of fraud patterns” and adding in its place the phrase “patterns of fraud”.

Title 16

Federal Trade Commission

For the reasons set forth in the preamble, 16 CFR chapter I is amended as follows:

28. Add a new part 641 to read as follows:

PART 641—DUTIES OF USERS OF CONSUMER REPORTS REGARDING ADDRESS DISCREPANCIES

641.1

Duties of users of consumer reports regarding address discrepancies.

Authority: Public Law 108-159, sec. 315; 15 U.S.C. 1681c(h).

§ 641.1

Duties of users of consumer reports regarding address discrepancies.

(a) Scope. This section applies to users of consumer reports that are subject to administrative enforcement of the FCRA by the Federal Trade Commission pursuant to 15 U.S.C. 1681s(a)(1) (users).

(b) Definition. For purposes of this section, a notice of address discrepancy means a notice sent to a user by a consumer reporting agency described in 15 U.S.C. 1681a(p) pursuant to 15 U.S.C. 1681c(h)(1), that informs the user of a substantial difference between the address for the consumer that the user provided to request the consumer report and the address(es) in the agency's file for the consumer.

(c) Reasonable belief—(1) Requirement to form a reasonable belief. A user must develop and implement reasonable policies and procedures designed to enable the user to form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report, when the user receives a notice of address discrepancy.

(2) Examples of reasonable policies and procedures. (i) Comparing the information in the consumer report provided by the consumer reporting agency with information the user:

(A) Obtains and uses to verify the consumer's identity in accordance with the requirements of the Customer Identification Program (CIP) rules implementing 31 U.S.C. 5318(l) (31 CFR 103.121);

(B) Maintains in its own records, such as applications, change of address notifications, other customer account records, or retained CIP documentation; or

(C) Obtains from third-party sources; or

(ii) Verifying the information in the consumer report provided by the consumer reporting agency with the consumer.

(d) Consumer's address—(1) Requirement to furnish consumer's address to a consumer reporting agency. A user must develop and implement reasonable policies and procedures for furnishing an address for the consumer that the user has reasonably confirmed is accurate to the consumer reporting agency described in 15 U.S.C. 1681a(p) from whom it received the notice of address discrepancy when the user:

(i) Can form a reasonable belief that the consumer report relates to the consumer about whom the user requested the report;

(ii) Establishes a continuing relationship with the consumer; and

(iii) Regularly and in the ordinary course of business furnishes information to the consumer reporting agency from which the notice of address discrepancy relating to the consumer was obtained.

(2) Examples of confirmation methods. The user may reasonably confirm an address is accurate by:

(i) Verifying the address with the consumer about whom it has requested the report;

(ii) Reviewing its own records to verify the address of the consumer;

(iii) Verifying the address through third-party sources; or

(iv) Using other reasonable means.

(3) Timing. The policies and procedures developed in accordance with paragraph (d)(1) of this section must provide that the user will furnish the consumer's address that the user has reasonably confirmed is accurate to the consumer reporting agency described in 15 U.S.C. 1681a(p) as part of the information it regularly furnishes for the reporting period in which it establishes a relationship with the consumer.

PART 681—IDENTITY THEFT RULES

29. The authority citation for part 681 is revised to read as follows:

Authority: Public Law 108-159, sec. 114; 15 U.S.C. 1681m(e).

30. Revise §§ 681.1 and 681.2 to read as follows:

§ 681.1

Duties regarding the detection, prevention, and mitigation of identity theft.

(a) Scope. This section applies to financial institutions and creditors that are subject to administrative enforcement of the FCRA by the Federal Trade Commission pursuant to 15 U.S.C. 1681s(a)(1).

(b) Definitions. For purposes of this section, and Appendix A, the following definitions apply:

(1) Account means a continuing relationship established by a person with a financial institution or creditor to obtain a product or service for personal, family, household or business purposes. Account includes:

(i) An extension of credit, such as the purchase of property or services involving a deferred payment; and

(ii) A deposit account.

(2) The term board of directors includes:

(i) In the case of a branch or agency of a foreign bank, the managing official in charge of the branch or agency; and

(ii) In the case of any other creditor that does not have a board of directors, a designated employee at the level of senior management.

(3) Covered account means:

(i) An account that a financial institution or creditor offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, such as a credit card account, mortgage loan, automobile loan, margin account, cell phone account, utility account, checking account, or savings account; and

(ii) Any other account that the financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft, including financial, operational, compliance, reputation, or litigation risks.

(4) Credit has the same meaning as in 15 U.S.C. 1681a(r)(5).

(5) Creditor has the same meaning as in 15 U.S.C. 1681a(r)(5), and includes lenders such as banks, finance companies, automobile dealers, mortgage brokers, utility companies, and telecommunications companies.

(6) Customer means a person that has a covered account with a financial institution or creditor.

(7) Financial institution has the same meaning as in 15 U.S.C. 1681a(t).

(8) Identity theft has the same meaning as in 16 CFR 603.2(a).

(9) Red Flag means a pattern, practice, or specific activity that indicates the possible existence of identity theft.

(10) Service provider means a person that provides a service directly to the financial institution or creditor.

(c) Periodic Identification of Covered Accounts. Each financial institution or creditor must periodically determine whether it offers or maintains covered accounts. As a part of this determination, a financial institution or creditor must conduct a risk assessment to determine whether it offers or maintains covered accounts described in paragraph (b)(3)(ii) of this section, taking into consideration:

(1) The methods it provides to open its accounts;

(2) The methods it provides to access its accounts; and

(3) Its previous experiences with identity theft.

(d) Establishment of an Identity Theft Prevention Program—(1) Program requirement. Each financial institution or creditor that offers or maintains one or more covered accounts must develop and implement a written Identity Theft Prevention Program (Program) that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. The Program must be appropriate to the size and complexity of the financial institution or creditor and the nature and scope of its activities.

(2) Elements of the Program. The Program must include reasonable policies and procedures to:

(i) Identify relevant Red Flags for the covered accounts that the financial institution or creditor offers or maintains, and incorporate those Red Flags into its Program;

(ii) Detect Red Flags that have been incorporated into the Program of the financial institution or creditor;

(iii) Respond appropriately to any Red Flags that are detected pursuant to paragraph (d)(2)(ii) of this section to prevent and mitigate identity theft; and

(iv) Ensure the Program (including the Red Flags determined to be relevant) is updated periodically, to reflect changes in risks to customers and to the safety and soundness of the financial institution or creditor from identity theft.

(e) Administration of the Program. Each financial institution or creditor that is required to implement a Program must provide for the continued administration of the Program and must:

(1) Obtain approval of the initial written Program from either its board of directors or an appropriate committee of the board of directors;

(2) Involve the board of directors, an appropriate committee thereof, or a designated employee at the level of senior management in the oversight, development, implementation and administration of the Program;

(3) Train staff, as necessary, to effectively implement the Program; and

(4) Exercise appropriate and effective oversight of service provider arrangements.

(f) Guidelines. Each financial institution or creditor that is required to implement a Program must consider the guidelines in appendix A of this part and include in its Program those guidelines that are appropriate.

§ 681.2

Duties of card issuers regarding changes of address.

(a) Scope. This section applies to a person described in § 681.1(a) that issues a debit or credit card (card issuer).

(b) Definitions. For purposes of this section:

(1) Cardholder means a consumer who has been issued a credit or debit card.

(2) Clear and conspicuous means reasonably understandable and designed to call attention to the nature and significance of the information presented.

(c) Address validation requirements. A card issuer must establish and implement reasonable policies and procedures to assess the validity of a change of address if it receives notification of a change of address for a consumer's debit or credit card account and, within a short period of time afterwards (during at least the first 30 days after it receives such notification), the card issuer receives a request for an additional or replacement card for the same account. Under these circumstances, the card issuer may not issue an additional or replacement card, until, in accordance with its reasonable policies and procedures and for the purpose of assessing the validity of the change of address, the card issuer:

(1)(i) Notifies the cardholder of the request:

(A) At the cardholder's former address; or

(B) By any other means of communication that the card issuer and the cardholder have previously agreed to use; and

(ii) Provides to the cardholder a reasonable means of promptly reporting incorrect address changes; or

(2) Otherwise assesses the validity of the change of address in accordance with the policies and procedures the card issuer has established pursuant to § 681.1 of this part.

(d) Alternative timing of address validation. A card issuer may satisfy the requirements of paragraph (c) of this section if it validates an address pursuant to the methods in paragraph (c)(1) or (c)(2) of this section when it receives an address change notification, before it receives a request for an additional or replacement card.

(e) Form of notice. Any written or electronic notice that the card issuer provides under this paragraph must be clear and conspicuous and provided separately from its regular correspondence with the cardholder.

§ 681.3

[Removed]

31. Remove § 681.3.

Appendix A to Part 681 [Amended]

32. Appendix A to Part 681 is amended by:

a. Revising the introduction;

b. Removing in sections VI(a)(2) and VI(b)(1) the term “§ 681.2,” and adding in its place the term “§ 681.1”;

c. Removing, in Supplement A to Appendix A, in paragraph 3, the term “§ 681.1(b)” and adding in its place the term “§ 641.1(b)”;

d. Removing, in Supplement A to Appendix A, in paragraph 15, the phrase “account number” and adding in its place the word “address”;

e. Removing, in Supplement A to Appendix A, in paragraph 15, the phrase “other customers” and adding in its place the phrase “by other customers”; and

f. Removing, in Supplement A to Appendix A, in paragraph 20, the phrase “patterns of fraud patterns” and adding in its place the phrase “patterns of fraud”.

The revision reads as follows:

Appendix A to Part 681—Interagency Guidelines on Identity Theft Detection, Prevention, and Mitigation

Section 681.1 of this part requires each financial institution and creditor that offers or maintains one or more covered accounts, as defined in § 681.1(b)(3) of this part, to develop and provide for the continued administration of a written Program to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. These guidelines are intended to assist financial institutions and creditors in the formulation and maintenance of a Program that satisfies the requirements of § 681.1 of this part.

* * * * *

PART 698—MODEL FORMS AND DISCLOSURES

33. The authority citation for part 698 continues to read as follows:

Authority: 15 U.S.C. 1681e, 1681g, 1681j, 1681m, 1681s, and 1681s-3; sections 211(d) and 214(b), Public Law 108-159, 117 Stat.1952.

34. Appendix C to Part 698 is amended by:

a. Redesignating Model Form C-5 as Model Form C-6; and

b. Adding new paragraph B.10 and new Model Form C-5 to read as follows:

Appendix C to Part 698—Model Forms for Opt-Out Notices

* * * * *

B. * * *

10. Adding disclosures regarding the treatment of opt-outs by joint consumers to comply with § 680.23(a)(2) of part 680.

* * * * *

C-5—Model Form for Voluntary “No Marketing” Notice

Your Choice To Stop Marketing

• [Name of Affiliate] is providing this notice.
• You may choose to stop all marketing from us and our affiliates.
• [Your choice to stop marketing from us and our affiliates will apply until you tell us to change your choice.]

To stop all marketing, contact us [include all that apply]:

• By telephone: 1-877-###-####
• On the Web: www..com
• By mail: Check the box and complete the form below, and send the form to:

[Company name]

[Company address]

_Do not market to me.

* * * * *

Appendix C to Part 698 [Amended]

35. Effective January 1, 2010, newly redesignated Model Form C-6 is removed.

By order of the Board of Governors of the Federal Reserve System, April 27, 2009.

Jennifer J. Johnson,

Secretary of the Board.

By the Office of the Comptroller of the Currency.

Julie L. Williams,

First Senior Deputy Comptroller and Chief Counsel.

By order of the Board of Directors, Federal Deposit Insurance Corporation.

Robert E. Feldman,

Executive Secretary.

By the Office of Thrift Supervision,

John E. Bowman,

Acting Director.

By order of the National Credit Union Administration Board.

Mary F. Rupp,

Secretary of the Board.

By direction of the Commission.

Donald S. Clark,

Secretary.

Footnotes

1.  The OCC, Board, FDIC, OTS and NCUA placed the final regulations implementing section 214 of the FACT Act in the part of their regulations that implement the FCRA—12 CFR parts 41, 222, 334, 571, and 717, respectively. The Commission placed the final regulations implementing section 214 of the FACT Act in 16 CFR parts 680 and 698. For ease of reference, the discussion in this preamble about technical corrections to the affiliate marketing final rules uses the shared numerical suffix of each of these agencies' regulations.

2.  The OCC, Board, FDIC, OTS and NCUA placed the final regulations implementing sections 114 and 315 in the part of their regulations that implement the FCRA—12 CFR parts 41, 222, 334, 571, and 717, respectively. In addition, the FDIC cross-references the regulations and guidelines in 12 CFR part 364. For ease of reference, the discussion in this preamble about the technical corrections to the address discrepancy rule and the identity theft rules uses the shared numerical suffix of each of these agency's regulations. The Commission has placed the final regulations and guidelines in the part of its regulations implementing the FCRA as follows: 16 CFR 641.1 for the address discrepancy rule, 16 CFR 681.1 for the red flags rule, and 16 CFR 681.2 for the card issuer rule. In addition, the Commission uses different numerical suffixes for these rules that equate to the numerical suffixes discussed in this preamble and the preamble to the final rule as follows: preamble suffix .82 = 16 CFR 641.1, preamble suffix .90 = 16 CFR 681.1, and preamble suffix .91 = 16 CFR 681.2. Because these technical amendments are placing the address discrepancy rule into its own part of the CFR, part 641, and are reordering the Commission's red flags rule and card issuer rule as 16 CFR 681.1 and 681.2, respectively, these technical amendments pertain to the Commission's address discrepancy, red flags, and card issuer rules.