A delay by the Federal Trade Commission extends the new “red flag” rules deadline until May 2009 giving dealerships time to make sure they comply with efforts to combat identification thefts.
Do dealers need the extra time? Apparently some do while others do not.
Creditors and financial institutions are required to identify “relevant indicators of identity theft. That is what red flags are,” says Paul Metrey, director-regulatory affairs, National Automobile Dealers Assn.
Dealers are included because auto loans originate at their stores.
Most dealers are aware of the rules and have made extensive efforts to comply, Metrey says, although others dispute that assessment.
’s dealer outreach efforts focus on making sure auto retailers have enough time to put Red Flag Rule programs in place and comply with the rule.
“The definition of creditor is very broad, and (the FTC) was concerned – this applies to creditors and financial institutions – that there were many entities and industries under the FTC jurisdiction that were not aware that they were actually covered by the Red Flag rule,” Metrey says.
brass, including Metrey, have traveled across the country getting the word out, holding at least 40 compliance presentations for state and metro dealer associations and at industry conventions.
Some of the NADA travel has resembled barnstorming, such as a three-day blitz that hit St. Louis and Kansas City, MO, Omaha, NE and Des Moines, IA.
Other stops included cities in Utah, Nevada, Illinois, New York, Kentucky Vermont and Pennsylvania.
“We visited nearly every part of the country, and that’s in addition to events such as webinars,” Metrey says. “NADA held four different Red Flag webinars. Participants signed up on a per location basis, which could have been one person up to several dozen people.”
Metrey says some state associations pulled 45-50 people into one location for a webinar. He estimates the various efforts reached several thousand people.
All indications point to dealers making extensive efforts to develop a compliant identity-theft prevention program, he says. “It helps not just in terms of satisfying the regulatory obligations, but also in protecting their dealerships.”
The Red Flag Rules require a senior dealership management employee to oversee the entire process as a so-called compliance officer.
Dealerships must have reasonable procedures in place to detect and respond to identity theft. Initially NADA opposed many of the proposed requirements on the premise they were beyond dealers’ investigative skills.
“A very big part of it is having a good identity-verification protocol, knowing who it is that’s sitting in front of you or that’s trying to do business over the phone or Internet with you,” Metrey says.
In some ways, dealers have been doing what the FTC now requires of them all along.
Says Metrey: “Dealers for a long time, because they are involved with the registration and titling process and insurance verification, frequently have had to obtain documents from a customer to verify identity, and they can certainly build that into their identity-theft protection program. They have already done steps that can be applied to this larger requirement.”
However, new requirements take it a step further. “There’s a lot of analysis involved,” he says. “They have to look at identity-theft risk and figure out how they’ll detect those risks and indicators, or red flags, and respond to them.”
Realistically, dealers need not be overly concerned with all 26 red-flag requirements that pertain to them, Metrey says. There only are about eight to 15 they should be concerned with.
“They have to keep on top of it,” he says. “And as they identify new risks, they have to change their programs to reflect the new risks and make sure their people are trained accordingly.”
Dealership finance managers play a key role. “They’re the ones that engage in the type of credit transactions that will be covered by these rules.”
Also playing a part are personnel focused on Internet credit-application activities. And the dealer principal, or general manager, needs to make sure proper oversight is in place.
While NADA believes most dealers are prepared, James Lawrence, director-dealer services for the dealer-services firm Compli, says only about 33% of dealers are in compliance and “thinking about it in a serious way.”
Extending the deadline has brought “a collective sigh of relief,” says Lawrence, whose company put on a series of red-flag webinars.
But the deadline extension applies more to enforcement than compliance, he says.
A dealership not following through with ID-theft safeguards may attract the attention of “a hungry lawyer,” who will dig into a store’s business practices and policies, trying to find gaps and turning them into legal issues, Lawrence says.
He says there are a lot of legal firms specifically designed to find gaps in compliance when a dealership is providing credit to a customer.
“The delay is all well and good, it will help a lot of folks get prepared,” he says. “It won’t be the FTC knocking on your door so much as a lawyer who understands the situation better than an average dealer.”