RegV_RedFlags_R_1255.20080206.omb

Supporting Statement for the

Disclosure Requirements and Recordkeeping Associated with

Regulation V (Fair Credit Reporting) (OMB No. 7100‑0308)

(Identity Theft Red Flags and Address Discrepancies - – Docket No. R-1255)

Summary

The Board of Governors of the Federal Reserve System, under delegated authority from the Office of Management and Budget (OMB), revised, without extension, the disclosure requirements associated with Regulation V, which implements the Fair Credit Reporting Act (FCRA) (OMB No. 7100‑0308).¹ The Board is required to renew these requirements every three years pursuant to the Paperwork Reduction Act of 1995 (PRA), which classifies disclosure and recordkeeping requirements of a regulation as “required information collections.”²

Currently Regulation V requires financial institutions that (1) extend credit and regularly and in the ordinary course of business furnish information to a nationwide consumer reporting agency (CRA) and (2) furnish negative information to a CRA regarding credit extended to a customer must provide a clear and conspicuous notice to the customer, in writing, about furnishing this negative information.³ In addition, under the affiliate marketing provision⁴ of Regulation V, financial institutions are prohibited from using certain information received from an affiliate to make a solicitation to a consumer unless the consumer is given notice and a reasonable opportunity to opt out of such solicitations, and the consumer does not opt out.

On July 18, 2006, the Federal Reserve published a joint⁵ notice of proposed rulemakingg (71 FR 40786) to implement the provisions in sections 114 and 315 (Red Flags) of the Fair and Accurate Credit Transactions Act (FACT Act) of 2003, which amends the FCRA. The proposed regulation Section 114 requires each financial institution to develop and implement a written Identity identity Ttheft Pprevention Pprogram to detect, prevent, and mitigate identity theft in connection with the opening of certain accounts or certain existing accounts. In addition, the Federal Reserve would issue guidelines to assist financial institutions in the formulation and maintenance of a Program that satisfies the requirements of the rule. The rule implementing sSection 114 also requires credit and debit card issuers, under certain circumstances, to assess the validity of notifications of changes of address under certain circumstances.

Additionally, the Federal Reserve issued joint rules under seSection 315 that provides guidance regarding reasonable policies and procedures that a user of consumer reports must employ when a consumer reporting agency sends the user a notice of address discrepancy. The comment period for this notice expired on September 18, 2006. The Federal Reserve received 54 fifty four comment letters from industry groups and consumers. On November 9, 2007, a joint notice of final rulemaking was published in the Federal Register adopting the amendments, with mandatory compliance by November 1, 2008 (72 FR 63718).

Currently Regulation V requires Ffinancial institutions that (1) extend credit and regularly and in the ordinary course of business furnish information to a nationwide consumer reporting agency (CRA), and (2) furnish negative information to such an agency regarding credit extended to a customer must provide a clear and conspicuous notice to the customer, in writing, about furnishing this negative information.⁶ In addition, Uunder the affiliate marketing provision, financial institutions are prohibited from using certain information received from an affiliate to make a solicitation to a consumer unless the consumer is given notice and a reasonable opportunity to opt out of such solicitations, and the consumer does not opt out. The current annual paperwork burden for furnishing these disclosures is estimated to be 107,840 hours. Under the final rule, to implement the sections 114 and 315Red Flags Red Flags provisions, the revisions are estimated to increase the annual burden to 155,892 hours.

Background and Justification

On December 4, 2003, the President signed into law the Fair and Accurate Credit Transactions Act of 2003 (FACT Act), which amends the FCRA.. In general, the FACT Act enhanceds the ability of consumers to combat identity theft, increasesd the accuracy of consumer reports, and alloweds consumers to exercise greater control regarding the type and amount of marketing solicitations they received. The FACT Act also restrictsrestricted the use and disclosure of sensitive medical information. To bolster efforts to improve financial literacy among consumers, the FACT Act createds a new Financial Literacy and Education Commission empowered to take appropriate actions to improve the financial literacy programs, education programs, grants, and materials of the Federal Government. Lastly, to promote increasingly efficient national credit markets, the FACT Act establisheds uniform national standards in key areas of regulation.

In theOn June 15, 2004, the Federal Reserve published a final rule (69 FR 33281, June 15, 2004) the Federal Reserve adopteding model forms that all financial institutions may use to comply with the notice requirement under section 217.⁷ Because a financial institution is allowed to send the notice relating to furnishing negative information prior to, or within thirty days after, it furnishes negative information, the model forms contain alternative language that a financial institution may use, depending on whether the notice is provided prior to, or after, furnishing negative information. The provisions in section 217 were effective December 1, 2004.⁸

On November 7, 2007, the Federal Reserve published a joint⁹ notice of final rulemaking (72 FR 62910) to implement the affiliate marketing provisions in section 214 of the FACT Act of 2003, which amends the FCRA. The regulations generally prohibits a person from using information received from an affiliate to make a solicitation for marketing purposes to a consumer, unless the consumer is given notice and an opportunity and simple method to opt out of the making of such solicitations. Compliance with the provisions in section 214 is mandatory effective October 1, 2008.

Description of Information Collection

Notice to Consumer Reporting Agency (Section 217)¹⁰

A financial institution generally may provide the notice about furnishing negative information on or with any notice of default, any billing statement, or any other materials provided to the customer, so long as the notice is clear and conspicuous. After providing such notice, the financial institution may submit additional negative information to a CRA described in section 603(p) of the FACT Act, with respect to the same transaction, extension of credit, account, or customer without providing additional notice to the customer. Section 217 specifically provides, however, that the notice may not be included in the initial disclosures provided under section 127(a) of the Truth in Lending Act (15 U.S.C. 1637(a)).¹¹

Section 217 also provides certain safe harbors for institutions concerning their efforts to comply with the notice requirement. A financial institution is deemed to be in compliance with the notice requirement if it uses the Federal Reserve’s model form, or uses the model form and rearranges its format. In addition, section 217 provides that a financial institution is not liable for failure to perform the duties required by this section if, at the time of the failure, the institution maintained reasonable policies and procedures to comply with the section or the institution reasonably believed that the institution was prohibited by law from contacting the customer.

Affiliate mMarketing oOpt-out nNotice rRequirements (Section 214)¹²

Specifically, affiliate marketing opt-out notice requirements provides that when a company communicates certain information about the consumer eligibility information to an affiliate, the affiliate may not use that information to make solicitations for marketing purposes to the consumer unless the consumer is given a notice and an opportunity to opt-out of that use of the information and the consumer does not opt-out. In general contents of opt-out notice must be clear, conspicuous, and concise, and must accurately disclose the name of the affiliate(s) providing the notice.

The notice must be provided by an affiliate that has or has previously had a pre-existing business relationship with the consumer; or as part of a joint notice from two or more members of an affiliated group of companies, provided that at least one of the affiliates on the joint notice has or has previously had a pre-existing business relationship with the consumer.

The election of a consumer to opt out must be effective for a period of at least five years beginning when the consumer’s opt-out election is received and implemented, unless the consumer subsequently revokes the opt-out in writing or, if the consumer agrees, electronically. An opt-out period of more than five years may be established, including an opt-out period that does not expire unless revoked by the consumer. A consumer may opt out at any time.

New Red Flags Provisions¹³

Identity Theft Red Flags and Address Discrepancies (Sections 114 and 315)¹⁴

Section 114 - The final rule implementing sSection 114 requires each financial institution to (1) create an Identity Theft Prevention Program (Program); (2) report to the board of directors, a committee thereof or senior management, at least annually, on compliance with the proposed regulations; and (3) train staff to implement the Program. In addition, the final rule requires each credit and debit card issuer (card issuer) to establish policies and procedures to (1) assess the validity of a change of address notification before honoring a request for an additional or replacement card received during at least the first 30 days after it receives the notification; and (2) notify the cardholder in writing, electronically, or orally, or use another means of assessing the validity of the change of address.

Address Discrepancies

(Section 315) -

The final rule implementing sSection 315 requires each user of consumer reports to (1) develop reasonable policies and procedures it employs when it receives a notice of address discrepancy from a CRA; and (2) to furnish an address the user reasonably confirmed is accurate to the CRA from which it receives a notice of address discrepancy.

Time Schedule for Information Collection

The Section 217, this notice requirement in Section 217 specifies that an institution must provide the required notice to the customer prior to, or no later than thirty days after, furnishing the negative information to a nationwide CRA. After providing the notice, the institution may submit additional negative information to a nationwide consumer reporting agency with respect to the same transaction, extension of credit, account, or customer without providing additional notice to the customer. If a financial institution has provided a customer with a notice prior to the furnishing of negative information, the institution is not required to furnish negative information about the customer to a nationwide CRA.

Section 214, this The notice requirement in Section 214 specifies that an institution must not use eligibility information about a consumer that it receives from an affiliate to make a solicitation to the consumer about the bank’s products or services, unless the consumer is provided a reasonable opportunity to opt out. The consumer is given thirty days from the date the notice is sent to elect to opt out by any reasonable means.

Consultation Outside the Agency

The Federal Reserve, OCC, FDIC, OTS, NCUA, and FTC collaborated in this rulemaking. On July 18, 2006, the Federal Reserve published a joint notice of proposed rulemaking (71 FR 40786) to implement the provisions in sections 114 and 315 of the FACT Act of 2003, which amends the FCRA. The comment period for this notice expired on September 18, 2006. The Federal Reserve received 54 fifty four comment letters from industry groups and consumers. On November 9, 2007, a joint notice of final rulemaking was published in the Federal Register adopting the amendments, with mandatory compliance by November 1, 2008 (72 FR 63718).

Sensitive Questions

This collection of information contains no questions of a sensitive nature, as defined by OMB guidelines.

Legal Status

The Board's Legal Division has determined that the FCRA, as amended, authorizes the Federal Reserve to issue regulations to carry out the provisions of the Act (15 U.S.C. §§1681b, 1681c, 1681m, and 1681s). Because the records are maintained at state member banks and the notices are not provided to the Federal Reserve, no issue of confidentiality arises under the Freedom of Information Act.

Estimate of Respondent Burden

The current annual respondent burden for this information collection is estimated to be 107,50840 hours. Approximately 30,000 financial institutions furnish information to CRAs. It is expectedThe Federal Reserve believes that providing the notice to consumers (under Section 217) would not significantly burden financial institutions because many provide a standardized notice to consumers routinely in connection with account openings prior to furnishing negative information. The Federal Reserve estimates that financial institutions with customized disclosures would take approximately fifteen minutes annually to update their notices with changes such as contact information.

U Under the affiliate marketing provisions (Section 214), the Federal Reserve estimates that the average amount of time for a financial institution to prepare and distribute an initial notice as required and distribute the notice to consumers would be approximately 18 eighteen hours. The Federal Reserve recognized that the amount of time needed for any particular financial institution subject to the final requirements may be higher or lower, but believed that this average figure was a reasonable estimate. To minimize the compliance costs and burdens for financial institution, particularly small entities, the final rule contains model disclosures and opt-out notices that may be used to satisfy the statutory requirements. The final rule gave covered financial institution flexibility to satisfy the notice and opt-out requirement by sending the consumer a free-standing opt-out notice or by adding the opt-out notice to the privacy notices already provided to consumers in accordance with the provisions of Title V of the GLBA. For covered financial institutions that choose to prepare a free-standing opt-out notice, the time necessary to prepare a free-standing opt-out notice would be minimal, because those financial institutions could simply copy the model disclosure, making minor adjustments as indicated by the model disclosure. Similarly, for covered financial institutions that choose to incorporate the opt-out notice into their GLBA privacy notices, the time necessary to integrate the model opt-out notice into their privacy notices would be minimal. The Federal Reserve estimates that the average consumer would take approximately five minutes to respond to the notice and opt-out.

Under the new Red Flags provisions (Sections 114 and 315), the Federal Reserve estimates the annual burden per respondent is forty-one hours; twenty-five hours to develop a Pprogram, four hours to prepare an annual report, four hours for training, four hours for developing policies and procedures to assess the validity of changes of address, and four hours for developing policies and procedures to respond to notices of address discrepancy. Under the final rule, to implement the Red Flags provisions, the revisions are estimated to increase the annual burden to 155,892 hours. This represents less than 1 percent of total annual Federal Reserve System paperwork burden.

	Number of respondents	Average annual frequency	Estimated average time per response	Estimated annual burden hours
Current
CRA notice (Section 217)	30,000	1	15 minutes	7,500
Affiliate Marketing opt-out notice (Section 214)
Financial Institutions	2,619	1	18 hours	47,142
Consumer Response	638,380	1	5 minutes	53,198
Total				107,840
Proposed
CRA notice (Section 217)	30,000	1	15 minutes	7,500
Affiliate Marketing opt-out notice (Section 214)
Financial Institutions	2,619	1	18 hours	47,142
Consumer Response	638,380	1	5 minutes	53,198
Identity Theft Red Flags and Address Discrepancies (Sections 114 and 315)	1,172	1	41 hours	48,052
Total				155,892
Change				48,052

The estimated cost to the public for this information collection is $4,295,119.¹⁵

Estimated Cost to the Federal Reserve System

Since the Federal Reserve does not collect any information, the cost to the Federal Reserve System is negligible.The annual cost to the Federal Reserve System for collecting this information is negligible since no data are collected.

Sensitive Questions

This collection of information contains no questions of a sensitive nature, as defined by OMB guidelines.

1 FCRA was enacted in 1970 and is codified at 15 U.S.C. § 1681 et seq. Regulation V is located at 12 C.F.R. Part 222.

2 44 U.S.C. § 3501 et seq.

3 Section 217 of the FACT Act defines the term “negative information” to mean information concerning a customer’s delinquencies, late payments, insolvency, or any form of default.

4 Affiliate Marketing Opt-out Notice Requirements (Section 214)

5 Office of the Comptroller of the Currency (OCC), Treasury; Federal Deposit Insurance Corporation (FDIC); Office of Thrift Supervision (OTS), Treasury; National Credit Union Administration (NCUA), and Federal Trade Commission (FTC)

6 Section 217 of the FACT Act defines the term “negative information” to mean information concerning a customer’s delinquencies, late payments, insolvency, or any form of default.

7 Under section 217, the term “financial institution” is defined broadly to have the same meaning as in the privacy provisions of the Gramm-Leach-Bliley Act of 1999 (GLB Act), which defines financial institution to mean “any institution the business of which is engaging in financial activities as described in section 4(k) of the Bank Holding Company Act of 1956,” whether or not affiliated with a bank. 15 U.S.C. 6809(3). Thus, the term “financial institution” includes not only institutions regulated by the Federal Reserve and other federal banking agencies, but also includes other financial entities, such as merchant creditors and debt collectors that extend credit and report negative information. 16 CFR 313.3(k) (65 FR 33646 and 33655, May 24, 2000).

Federal Reserve-covered institutions are defined by Regulation V as: banks that are members of the Federal Reserve System (other than national banks), branches and Agencies of foreign banks (other than Federal branches, Federal Agencies, and insured State branches of foreign banks), commercial lending companies owned or controlled by foreign banks, organizations operating under section 25 or 25A of the Federal Reserve Act (12 U.S.C. 601 et seq., and 611 et seq.), and bank holding companies and affiliates of such holding companies (other than depository institutions and consumer reporting agencies).

8 69 FR 6526 (February 11, 2004).

9 OCC, FDIC, OTS, and NCUA

10 (12 CFR, Part 222, appendix B)

11 The collection of information under Regulation Z is assigned OMB No. 7100-0199 for purposes of the PRA.

12 (12 CFR, Parts: 222.21– 222.27)

13 (12CFR, Parts: 222.82, 222.90, and 222.91)

14 (12CFR, Parts: 222.82, 222.90, and 222.91)

15 Total cost to the public was estimated using the following formula. Percent of staff time, multiplied by annual burden hours, multiplied by hourly rate: 75% - Clerical @ $25, and 25% - Managerial or Technical @ $55, . 0% - Senior Management @ $100, and 0% - Legal Counsel @ $144. Hourly rate estimates for each occupational group are averages using data from the Bureau of Labor and Statistics, Occupational Employment and Wages, news release. Consumer cost of $18 is based on the U.S. Department of Labor Bureau of Labor Statistics, 2002 Quarterly Census of Employment and Wages http://www.bls.gov/cew/state2002.txt

6