OCC Bulletin 2004-60| December 28, 2004
Fair Credit Reporting Act: Final Rule: Related Identity Theft Definitions, Duration of Active Duty Alerts, and Appropriate Proof of Identity
Chief Executive Officers and Compliance Officers of All National Banks, Department and Division Heads, and All Examining Personnel
The Federal Trade Commission (FTC) published the attached final rule in the Federal Register on November 3, 2004. The final rule, which became effective on December 1, establishes definitions for the terms, "identity theft" and "identity theft report;" the duration of an "active duty alert;" and the "appropriate proof of identity" for purposes of sections 605A (fraud alerts and active duty alerts), 605B (consumer report information blocks), and 609(a)(1) (truncation of Social Security numbers) of the Fair Credit Reporting Act (FCRA), as amended by the Fair and Accurate Credit Transactions Act (FACTA). FCRA sections 605A, 605B, and 609(a)(1) became effective on December 1.
While sections 605A, 605B, and 609(a)(1) of the FCRA largely relate to credit reporting agencies (CRAs), if a national bank is a CRA, these definitions are important in complying with those sections. However, the definitions in the final rule are also applicable to other provisions in the FCRA that more commonly apply to national banks. For example, section 623(a)(6) contains requirements applicable to furnishers of consumer information to CRAs, including national banks. Under this section, when a CRA notifies a furnisher that the furnisher has provided information to the CRA that is blocked because it was the result of identity theft, the furnisher must have reasonable procedures in place to prevent re-furnishing the blocked information. In addition, if a consumer submits an "identity theft report" directly to a furnisher stating that the information the furnisher maintains about the consumer is a result of "identity theft," the furnisher may not provide that information to a CRA unless the furnisher subsequently knows or is told by the consumer that the information is correct. Further, section 615(f) prohibits the sale, transfer, or placing for collection of a debt, which the holder has been notified by a CRA is the result of identity theft. The requirements in sections 623(a)(6) and 615(f) went into effect December 1.
Questions concerning this final rule may be directed to your supervisory office or to Carol Turner, compliance specialist, Compliance Department at (202) 649-5470.
Ann F. Jaedicke
Deputy Comptroller for Compliance Policy