Waving the Red Flag on Identity Theft

In short, if an investment advisory firm has the capacity to withdraw funds from client accounts and transfer those funds to unrelated third parties (commonly defined as having custody), that firm generally has a "transaction account" and therefore meets the definition of a "financial institution" for the purposes of the updated red flag requirements.

So how should affected firms comply with the red flag regulations?

Develop policies and procedures to identify and respond to red flags. Affected firms are required to adopt policies and procedures designed to detect and address "reasonably foreseeable risks" of identity theft. The red flag ­policies should be tailored to an affected entity's business model; the type of accounts maintained for its clients; its methods to open or access the affected accounts; and its prior experiences with identity theft.

Develop oversight plan. Affected firms should develop and approve an oversight plan, which should include assigning specific responsibility for the policies' implementation to an individual or committee who will report to the board of directors or designated senior management employee as appropriate; and to issue reports to firm management prepared by staff (generally the chief compliance officer) about the firm's compliance with red flag regulations.

Implement response policies. As part of its red flag policy program, the firm will be required to appropriately respond to identity theft red flags, which could include monitoring a covered account for evidence of identity theft and notifying law enforcement when appropriate.

Update red flag policies as necessary. Finally, the firm is required to periodically review and update the red flag policies as appropriate.