Red Flags Rule: get ready to comply: FTC to begin enforcement Dec. 31.

• Position: RegulatoryIssues

the Federal Trade

Commission will begin enforcement of its Red Flags Rule Dec. 31, 2010. for financial institutions and creditors subject to the FTC's jurisdiction including CPA firms. Businesses that bill customers for sales or services after services have been performed, even in the normal course of a traditional billing process are considered a "creditor" under the current Red Flags Rule that has yet to go into effect.

The following is a brief rundown of the new rule, how it affects CPAs and how CPAs can make sure they are in compliance.

ID Theft Protection

The Red Flags Rule was developed under the Fair and Accurate Credit Transactions Act, in which Congress directed the FTC and other agencies to develop regulations requiring "creditors" and "financial institutions" to address the risk of identity theft. The resulting rule requires all such entities that have "covered accounts" to develop and implement written identity theft prevention programs to detect the warning signs--or red flags of identity theft in their day-to-day operations.

Who's Affected?

According to the AICPA, CPAs could become subject to the rule since recent interpretations from the FTC to other professional organizations, such as lawyers and physicians, indicate that a "creditor" includes "any entity that defers payments, even in the normal course of a traditional billing process." Thus, if a CPA bills clients monthly, this could be considered an extension of credit that would require the CPA to have an internal program subject to inspection and review designed to detect, prevent and mitigate client identity theft.

The rule initially became effective Jan. 1, 2008, with full compliance for all covered entities originally required by Nov. 1, 2008. The FTC has issued several Enforcement Policies delaying enforcement of the rule as Congress finalized legislation that would limit the scope of business covered.

Pending Legal Actions

The AICPA has a lawsuit (filed Nov 10, 2009) pending in the United States District Court for the District of Columbia that seeks a bar against the application of the rule to CPAs and accounting firms. The AICPA's suit, in part, asserts that the FTC exceeded its statutory authority by extending the rule to regulate accountants and public accounting firms. The AICPA does not believe there is any reasonably foreseeable risk of identity theft when CPA clients are billed for services rendered.

Earlier this year, AICPA members in public accounting were...