In an unexpected move, the Federal Trade Commission (FTC) announced that it will delay its planned enforcement deadline of the Red Flags Rules to May 1, 2009. The rule, which was designed to deputize lenders and creditors — including auto dealers — in the federal government's campaign against identity theft, went into effect Jan. 1 of this year. The original compliance deadline was Nov. 1.

The FTC explained the decision in an official Enforcement Policy Statement. "Given the confusion and uncertainty within major industries under the FTC's jurisdiction about the applicability of the rule, and the fact that there is no longer sufficient time for members of those industries to develop their programs and meet the Nov. 1 compliance date, the Commission believes that immediate enforcement of the rule on Nov. 1 would be neither equitable for the covered entities nor beneficial to the public. Delaying Commission enforcement of the rule as to the entities under its jurisdiction by six months ... will allow these entities to take the appropriate care and consideration in developing and implementing their programs. It also will give the Commission time to conduct additional education and outreach regarding the rule."

The delay impacts organizations that fall under the FTC's jurisdiction, such as auto dealers. However, organizations such as banks and financial institutions, which fall under the jurisdiction of other regulatory agencies, will still need to have their Red Flags program in place by Nov. 1.

Despite the delayed compliance deadline, dealers are still expected to have policies in place by Nov. 1 to address the two other rules passed in conjunction with the Red Flags Rules. One of the rules covers notices of address discrepancies when a credit bureau is pulled by a dealer. The other mandates that credit and debit card issuers have policies in place to address a change of address.

"There are two tiers of liability for dealers when it comes to the address discrepancy rule," said Michael Goodman, an attorney with Hudson Cook LLP. "First of all, for all users of consumer report info, your burden kicks in when you get a notice of address discrepancy from a credit bureau. You need to have procedures in place to try and resolve the discrepancy. That means going through the identity info you have for the consumer, going through your own records, or using a third-party source to resolve the discrepancy."

The address discrepancy rule also applies to dealers who provide information back to credit bureaus. "If you're a dealer that furnishes info and you get a notice of address discrepancy and you're able to resolve it and you end up doing business with the customer, then you need to report your verified result to the bureau," said Goodman. "This rule also reaches dealers such as buy-here-pay-here operations because they have a continuing relationship with a customer. So they are likely to furnish information to the credit bureau."

Like the Red Flags Rules, the two obligations and related penalties fall under the Fair Credit Reporting Act, which caries fines of up to $2,500 per violation.

"What I've heard is that people who are subject to the [Red Flags Rules] under the FTC's jurisdiction were basically scrambling leading up to Nov. 1 to get into compliance," said Goodman. "I think it's fair to say there were pretty widespread problems meeting that deadline."