Quick Answer
A red flag is a pattern, practice, or specific activity indicating the possible existence of identity theft, and operations personnel recognize it before anything is confirmed. Identity verification is one area where such an indicator arises. Route it through the firm's escalation process under that process's own terms, rather than treating every indicator as separately reportable.
After identifying complaints, apply the same recognition discipline to warning signs that may indicate identity theft.
Must Identity Theft Be Confirmed Before the Firm Responds?
- A potential red flag is a pattern, practice, or specific activity that indicates the possible existence of identity theft.
- The firm's written Identity Theft Prevention Program must include reasonable policies and procedures to identify relevant red flags, detect incorporated red flags, and respond appropriately to detected red flags.
- The word potential matters. The firm can apply its procedures before identity theft is confirmed.
- The program must include procedures for appropriate responses. Those procedures should make responses commensurate with the degree of risk. Depending on the circumstances, the firm may determine that no response is warranted.
Which Identification-Verification Control Is Implicated?
- Reasonable procedures verify the identity of a person seeking to open an account to the extent reasonable and practicable.
- The firm retains records of the identifying information used, including name, address, and other identifying information.
- The firm checks lists of known or suspected terrorists or terrorist organizations issued by a federal agency and designated by Treasury.
- An identification-verification concern that indicates possible identity theft can be a potential red flag under the firm's procedures.
- The relevant exam focus is the warning indicator and the firm's appropriate response, not a confirmed outcome.
Exam Tip: Gotchas
- A red flag does not prove identity theft. The firm can apply its procedures before the underlying problem is completed or confirmed.
- A customer notice can be a red flag. A customer concern about possible identity theft can also be a warning indicator.
What Should You Check on Exam Day?
- Apply the firm's procedures without waiting for confirmed identity theft.
- Distinguish the standards: the program must include procedures for appropriate responses. Those procedures should make responses commensurate with the risk. The firm may determine that no response is warranted.
- Verify the identity of the person seeking to open the account to the extent reasonable and practicable.
- Retain the identifying information used in verification.
- Check lists issued by a federal agency and designated by Treasury.