|
Ready or Not, Funds Face Red Flag Rules
Ignites
April 29, 2009
Despite a deadline extension for compliance with the so-called red flag rules, there is some lingering concern about fund shops' preparedness to adhere to them.
The rules were announced in October 2007 and mandate that financial institutions create and implement written identity theft plans to safeguard shareholders in transactional accounts. The rules are far-reaching and cover institutions ranging from credit card companies to health care providers to utilities.
Because it is a Federal Trade Commission rule, many groups that are not regulated by the FTC were unaware that they had to comply with the original Nov. 1, 2008, compliance deadline. As a result, the fund industry and other sectors were given a six-month extension.
"I don't think that come May 1 the FTC will come knocking on the doors of financial institutions," says Timothy Blank, a litigation partner with Dechert. "But if you have a data loss that could have been prevented or mitigated had you been in compliance, you will have a steep regulatory price to pay."
Most funds had procedures and policies for most of the 26 "flags" identified by the rule, but consolidating those procedures into one document, training staff and getting boards to sign off before the original Nov. 1 deadline represented a challenge. Blank says he believes most fund shops are prepared to comply with the new rules.
Many funds have addressed a crucial requirement of the red flag rules: To have a dedicated person in charge of data, Blank says. Funds have had to be prepared because they are a natural target ripe with information that fraudsters crave, he says.
"There is a growing organized crime industry for data and identity theft, and the techniques used are more and more sophisticated," Blank says. "The data that the fund companies process is the exact type of data that the criminals want."
Blank urges that funds help shape the policy by reaching out to regulators with questions and concerns as they follow the rules.
"As with any new rules, regulators themselves are not entirely clear as to how they intend to enforce it," he says. "They don't have black-and-white answers to these regulations."
|
