The Federal Trade Commission will begin enforcing its Red Flags Rule this Sunday, November 1.  Financial institutions and creditors that hold covered accounts, as defined under the Rule, must have written Red Flags identity theft prevention programs in place by November 1.   Earlier today the American Bar Association reported that a federal judge in Washington, D.C., ruled that the FTC exceeded its authority by applying the Red Flags Rule to practicing lawyers.  The FTC is expected to appeal today's ruling.

In 2007, the FTC, the federal bank regulatory agencies, and the National Credit Union Administration issued final rules requiring financial institutions and creditors to develop and implement written identity theft prevention programs, as part of the Fair and Accurate Credit Transactions Act of 2003. The FTC (but not the federal bank regulatory agencies) extended the deadline for enforcement three times:  from November 1, 2008, to May 1, 2009, to August 1, 2009, and finally to November 1, 2009.