Home  News Room 

FTC's Red Flags Rule Applies to Colleges

NAICU Washington Update

October 7, 2008

Late last year, the Federal Trade Commission issued a regulation known as the "Red Flags Rule" to reduce identity theft. Creditors or financial institutions holding accounts covered by the rule must develop a written identity theft prevention program. While the FTC generally does not have jurisdiction over not-for-profit entities, parts of the rule seem to apply to a variety of college and university activities.

Colleges could be considered creditors through participating in the Perkins Loan Program; being a school lender in the Federal Family Education Loan Program (FFELP); offering institutional loans to students, faculty, or staff; or offering a plan for payment of tuition throughout the school year. Consumer accounts involving multiple transactions fall under the rule, and last July, the FTC issued guidance stating that where "non-profit and government entities defer payment for goods or services, they, too, are to be considered creditors."

Compliance with the rule is required by November 1, 2008, and the institution's identity theft prevention program must be approved by its board or a committee of the board. The National Association of College and University Business Officers (NACUBO) has provided a more detailed explanation of the rule to college business officers. Also, available on the FTC Web site is a brief description of the rule and a link to the text of the rule in the Federal Register. Consult your business officer and/or attorney to determine the implications for your institution.

Contact

• Maureen Budetti
  maureen@naicu.edu