Fair Credit Reporting Affiliate Marketing Regulations; Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003, 22639-22646 [E9-10009]

Agencies

• FEDERAL DEPOSIT INSURANCE CORPORATION
• FEDERAL RESERVE SYSTEM
• FEDERAL TRADE COMMISSION
• National Credit Union Administration
• Office of the Comptroller of the Currency
• DEPARTMENT OF THE TREASURY
• Office of Thrift Supervision
• Comptroller of the Currency

[Federal Register Volume 74, Number 92 (Thursday, May 14, 2009)]
[Rules and Regulations]
[Pages 22639-22646]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E9-10009]



========================================================================
Rules and Regulations
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains regulatory documents 
having general applicability and legal effect, most of which are keyed 
to and codified in the Code of Federal Regulations, which is published 
under 50 titles pursuant to 44 U.S.C. 1510.

The Code of Federal Regulations is sold by the Superintendent of Documents. 
Prices of new books are listed in the first FEDERAL REGISTER issue of each 
week.

========================================================================


Federal Register / Vol. 74, No. 92 / Thursday, May 14, 2009 / Rules 
and Regulations

[[Page 22639]]



DEPARTMENT OF THE TREASURY

Office of the Comptroller of the Currency

12 CFR Part 41

[Docket ID OCC-2009-0001]
RIN 1557-AD14

FEDERAL RESERVE SYSTEM

12 CFR Part 222

[Regulation V; Docket No. R-1203, R-1255]

FEDERAL DEPOSIT INSURANCE CORPORATION

12 CFR Part 334

RIN 3064-AC83; 3064-AD00

DEPARTMENT OF THE TREASURY

Office of Thrift Supervision

12 CFR Part 571

[Docket ID OTS-2008-0024]
RIN 1550-AC30

NATIONAL CREDIT UNION ADMINISTRATION

12 CFR Part 717

RIN 3133-AC90 and RIN 3133-AD00

FEDERAL TRADE COMMISSION

16 CFR Parts 641, 681, and 698

RIN 3084-AA94


Fair Credit Reporting Affiliate Marketing Regulations; Identity 
Theft Red Flags and Address Discrepancies Under the Fair and Accurate 
Credit Transactions Act of 2003

AGENCIES: Office of the Comptroller of the Currency, Treasury (OCC); 
Board of Governors of the Federal Reserve System (Board); Federal 
Deposit Insurance Corporation (FDIC); Office of Thrift Supervision, 
Treasury (OTS); National Credit Union Administration (NCUA); and 
Federal Trade Commission (Commission).

ACTION: Final rules; technical corrections.

-----------------------------------------------------------------------

SUMMARY: The OCC, Board, FDIC, OTS and NCUA published in the Federal 
Register final rules to implement the affiliate marketing provisions of 
the Fair and Accurate Credit Transactions Act of 2003 (FACT Act) on 
November 7, 2007. The Commission published its final affiliate 
marketing rule on October 30, 2007. The OCC, Board, FDIC, OTS, NCUA and 
the Commission (Agencies) published in the Federal Register final rules 
and guidelines to implement the identity theft red flags and address 
discrepancy provisions of the FACT Act on November 9, 2007. The 
technical corrections included in this Federal Register document revise 
one of the affiliate marketing model forms and the instructions to the 
model forms to correct inadvertent omissions and conform the model 
forms and the instructions to the affiliate marketing rules, and 
correct minor errors in the identity theft red flags and address 
discrepancy rules and guidelines. The substantive requirements of the 
affiliate marketing and the identity theft red flags and address 
discrepancy rules are unchanged.

DATES: These final rules are effective May 14, 2009, except for the 
amendments in instructions 4, 10, 15, 20, 26, and 34 relating to 
appendices C to 12 CFR parts 41, 222, 334, 571, 717 and 16 CFR part 
698, respectively, which are effective January 1, 2010.

FOR FURTHER INFORMATION CONTACT:
    OCC: Jon Mitchell, Attorney, Legislative and Regulatory Activities 
Division, (202) 874-5090, Office of the Comptroller of the Currency, 
250 E Street, SW., Washington, DC 20219.
    Board: Amy E. Burke, Senior Attorney, or Jelena McWilliams, 
Attorney, Division of Consumer and Community Affairs, (202) 452-3667 or 
(202) 452-2412; or Kara Handzlik, Attorney, Legal Division, (202) 452-
3852, Board of Governors of the Federal Reserve System, 20th and C 
Streets, NW., Washington, DC 20551. For users of a Telecommunications 
Device for the Deaf (TDD) only, contact (202) 263-4869.
    FDIC: Richard M. Schwartz, Counsel, Legal Division, (202) 898-7424; 
Jeffrey M. Kopchik, Senior Policy Analyst, (202) 898-3872, or Samuel 
Frumkin, Senior Policy Analyst, (202) 898-6602, Division of Supervision 
and Consumer Protection, Federal Deposit Insurance Corporation, 550 
17th Street, NW., Washington, DC 20429.
    OTS: Suzanne McQueen, Consumer Regulations Analyst, Compliance and 
Consumer Protection Division, (202) 906-6459; April Breslaw, Director, 
Consumer Regulations, (202) 906-6989; or Richard Bennett, Senior 
Compliance Counsel, Regulations and Legislation Division, (202) 906-
7409, Office of Thrift Supervision, 1700 G Street, NW., Washington, DC 
20552.
    NCUA: Linda Dent, Attorney, or Regina Metz, Attorney, Office of 
General Counsel, 703-518-6540, National Credit Union Administration, 
1775 Duke Street, Alexandria, VA 22314-3428.
    Commission: Anthony Rodriguez (Affiliate Marketing Rule) or Cora 
Han (Identity Theft Red Flags Rules), Attorneys, Division of Privacy 
and Identity Protection, Bureau of Consumer Protection, (202) 326-2252, 
Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 
20580.

SUPPLEMENTARY INFORMATION: 

Technical Corrections to Affiliate Marketing Final Rules

    This final rule includes technical corrections to the affiliate 
marketing rules (72 FR 61424 and 72 FR 62910) that conform the model 
notices and instructions to the model notices to the requirements of 
the affiliate marketing rules. The first technical correction revises 
current Model Form C-5, one of several optional safe harbor forms 
provided in the Agencies' regulations, to include language about the 
duration of a consumer's opt-out. Pursuant to Sec. --.23(a)(1)(v) of 
the affiliate marketing rules, an affiliate marketing opt-out notice 
must disclose accurately ``[t]hat the consumer's election will apply 
for the specified period of time stated in the notice and, if 
applicable, that the consumer will be allowed to renew the election 
once that period expires.'' \1\

[[Page 22640]]

Model Form C-5 is the model form that can be used by a person to 
provide a voluntary opt-out from all marketing by that person and its 
affiliates. The version of Model Form C-5 promulgated in the fall of 
2007 does not include any information about the duration of the opt-
out. By contrast, Model Forms C-1 and C-2 include model language that 
explains the duration of the consumer's opt-out choice.
---------------------------------------------------------------------------

    \1\ The OCC, Board, FDIC, OTS and NCUA placed the final 
regulations implementing section 214 of the FACT Act in the part of 
their regulations that implement the FCRA--12 CFR parts 41, 222, 
334, 571, and 717, respectively. The Commission placed the final 
regulations implementing section 214 of the FACT Act in 16 CFR parts 
680 and 698. For ease of reference, the discussion in this preamble 
about technical corrections to the affiliate marketing final rules 
uses the shared numerical suffix of each of these agencies' 
regulations.
---------------------------------------------------------------------------

    In order to ensure that the content of the model form is consistent 
with the requirements of the regulation, the Agencies are inserting 
bracketed language into Model Form C-5 that a person may use to 
disclose the duration of the opt-out period. The new language is based 
on the assumption that persons providing to consumers a broader right 
to opt out will not limit the duration of the opt-out period and will 
allow any voluntary ``no-marketing'' opt-out to remain in effect until 
the consumer changes his or her choice. If that is not the case, then 
alternate language accurately describing the duration of the opt-out 
period must be substituted for the new bracketed language in the 
revised Model Form C-5.
    The version of Model Form C-5 promulgated in the fall of 2007 is 
being renumbered as Model Form C-6. To give industry adequate time to 
revise their model forms, the safe harbor for Model Form C-6 will 
remain in effect until January 1, 2010.
    The second technical correction involves joint relationships. 
Section--.23(a)(2) of the affiliate marketing rules permits a single 
opt-out notice to be provided to joint consumers and specifies that the 
opt-out notice must disclose how an opt-out direction by a joint 
consumer will be treated. The model forms and instructions to the model 
forms currently are silent on joint relationships.
    In order to ensure that the instructions are consistent with the 
requirements of the regulation, the Agencies are inserting an 
additional provision into the instructions for acceptable changes to 
the model forms clarifying that a person may add to the model forms a 
disclosure regarding the treatment of opt-outs by joint consumers to 
comply with the requirements of Sec. --.23(a)(2). Where the notice 
pertains to a joint account, the person must include such language 
under Sec. --.23(a)(2). Where the notice pertains to an account that is 
not a joint account, the person may, but is not required to, include 
language on joint accounts. A statement about joint accounts in an opt-
out notice must be clear, conspicuous, and concise, and must accurately 
reflect the institution's policy regarding the treatment of opt-outs by 
joint consumers. For example, where the notice pertains to a joint 
account and the opt-out will apply to everyone on the account, the 
statement may provide that, for joint accounts, the opt-out will apply 
to everyone on the account.

Technical Corrections to Identity Theft Red Flags and Address 
Discrepancies Final Rules

    The technical corrections to the identity theft red flags and 
address discrepancy rules included in this final rule clarify that 
address discrepancy notices are provided only by the nationwide CRAs 
described in section 603(p) of the FCRA (15 U.S.C. 1681a(p)). These 
corrections to Sec. --.82 conform the address discrepancy rules to the 
statute.\2\
---------------------------------------------------------------------------

    \2\ The OCC, Board, FDIC, OTS and NCUA placed the final 
regulations implementing sections 114 and 315 in the part of their 
regulations that implement the FCRA--12 CFR parts 41, 222, 334, 571, 
and 717, respectively. In addition, the FDIC cross-references the 
regulations and guidelines in 12 CFR part 364. For ease of 
reference, the discussion in this preamble about the technical 
corrections to the address discrepancy rule and the identity theft 
rules uses the shared numerical suffix of each of these agency's 
regulations. The Commission has placed the final regulations and 
guidelines in the part of its regulations implementing the FCRA as 
follows: 16 CFR 641.1 for the address discrepancy rule, 16 CFR 681.1 
for the red flags rule, and 16 CFR 681.2 for the card issuer rule. 
In addition, the Commission uses different numerical suffixes for 
these rules that equate to the numerical suffixes discussed in this 
preamble and the preamble to the final rule as follows: preamble 
suffix .82 = 16 CFR 641.1, preamble suffix .90 = 16 CFR 681.1, and 
preamble suffix .91 = 16 CFR 681.2. Because these technical 
amendments are placing the address discrepancy rule into its own 
part of the CFR, part 641, and are reordering the Commission's red 
flags rule and card issuer rule as 16 CFR 681.1 and 681.2, 
respectively, these technical amendments pertain to the Commission's 
address discrepancy, red flags, and card issuer rules.
---------------------------------------------------------------------------

    This final rule also corrects four minor typographical errors in 
the final rules and supplement to the guidelines implementing section 
114 of the FACT Act (72 FR 63718).
    This final rule also corrects a minor error in the scope section of 
the Board's final rules regarding identity theft red flags. The Board's 
correction to Sec.  222.90(a) clarifies that operating subsidiaries of 
member banks of the Federal Reserve System (other than national banks) 
that are functionally regulated within the meaning of section 5(c)(5) 
of the Bank Holding Company Act, as amended (12 U.S.C. 1844(c)(5)) are 
not covered by the Board's rule.
    This final rule places section 681.1 of the Commission's final rule 
into its own separate part of the CFR, part 641, in order to clarify 
that it pertains to the duties of users of consumer reports regarding 
address discrepancies. Current sections 681.2 and 681.3, which pertain 
to identity theft, are reordered as sections 681.1 and 681.2 
respectively, and references to these sections in the appendices are 
corrected as necessary.
    The final rule further revises a caption of the NCUA's final rule 
to clarify which section pertains to the duties of card issuers 
regarding changes of address.

Basis for the Corrections

    The Agencies are issuing these technical corrections as final 
rules. Under the Administrative Procedure Act, 5 U.S.C. 551, et seq., 
publication of a notice of proposed rulemaking is not required for 
interpretative rules, general statements of policy, or rules of agency 
organization, procedure, or practice, or when an agency for good cause 
finds (and incorporates the finding and a brief statement of reasons in 
the rules issued) that notice and public procedures are impracticable, 
unnecessary, or contrary to the public interest. In addition, a rule 
may be made effective less than thirty days from publication when an 
agency finds good cause for such action. 5 U.S.C. 553(b)(A)-(B) and 
(d)(3). The Agencies find that a notice of proposed rulemaking is not 
required. First, many of the revisions are interpretative in that they 
indicate how substantive requirements of the rules apply. In addition, 
notice is unnecessary because the technical corrections do not change 
or modify the substantive requirements of the provisions amended. 
Further, the Agencies find good cause for an immediate effective date 
because it is unnecessary and contrary to the public interest to delay 
the effectiveness of those revisions.
    With respect to the affiliate marketing rule, the corrections do 
not establish new regulatory requirements. They merely clarify, through 
revisions to the model forms and instructions to the model forms, how 
persons can meet the requirements of the final rules. The Agencies 
unintentionally omitted the clarifications to the model form and 
instructions to the model forms and find that it would be potentially 
misleading, and therefore contrary to the public interest, to delay 
issuance of the revised model form and instructions to the model forms 
that conform to the rule.
    The Agencies recognize that industry may be relying on the safe 
harbor

[[Page 22641]]

provided by the version of Model Form C-5 promulgated in the fall of 
2007. See 72 FR 62910. In order to allow persons subject to the rules 
adequate time to revise applicable opt-out forms to conform to the 
revised Model Form C-5, the safe harbor for Model Form C-5 promulgated 
in the fall of 2007, which is being renumbered as Model Form C-6, will 
remain in effect until January 1, 2010. Use of the revised Model Form 
C-5 published today complies with the requirements of the rule 
effective immediately. Thus, until January 1, 2010, the safe harbor is 
available for a person that uses either form. On and after January 1, 
2010, the safe harbor is available only for use of revised Model Form 
C-5.
    Because the corrections to the final rules and supplement to the 
guidelines implementing section 114 of the FACT Act are typographical 
in nature, or simply clarify the rule by conforming it to the statute, 
the Agencies find that it is unnecessary to publish a notice of 
proposed rulemaking or to delay the effective date of the corrections. 
Furthermore, the Board finds that it is unnecessary to publish a notice 
of proposed rulemaking to include a clarification that was 
unintentionally omitted from the scope section of the Board's final 
rules regarding identity theft red flags. The addition of language 
specifying the types of operating subsidiaries that are covered by the 
Board's rules provides more precise clarification in the regulation of 
the scope of the Board's statutory enforcement authority of the rule. 
15 U.S.C. 1681s. In addition, the FTC finds that it is unnecessary to 
publish a notice of proposed rulemaking regarding its placing of 
section 681.1 of the Commission's final rule into a separate part of 
the CFR, part 641, for purposes of clarifying that this section 
pertains to the duties of users of consumer reports regarding address 
discrepancies. The clarification does not change the text or scope of 
the regulation.
    Further, section 302 of the Riegle Community Development and 
Regulatory Improvement Act of 1994 provides that federal banking agency 
regulations that impose additional reporting, disclosure, or other new 
requirements may not take effect before the first day of the quarter 
following publication, unless the agency determines, for good cause 
published with the regulation, that the regulation should become 
effective before such time. 12 U.S.C. 4802. For the same reasons as 
already discussed, the OCC, Board, FDIC, and OTS find good cause for an 
immediate effective date on grounds that it is unnecessary and contrary 
to the public interest to delay the effectiveness of those revisions.

Regulatory Analysis

Paperwork Reduction Act

    In accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 
3506; 5 CFR 1320 Appendix A.1), the Agencies have reviewed the final 
rules. The rules contain no collections of information pursuant to the 
Paperwork Reduction Act.

Executive Order 12866

    The OCC and OTS have determined that their respective portions of 
the final rules are not significant regulatory actions under Executive 
Order 12866.

Regulatory Flexibility Act

    The Regulatory Flexibility Act (RFA) does not apply to a rulemaking 
where a general notice of proposed rulemaking is not required. 5 U.S.C. 
603 and 604. As noted previously, the Agencies have determined that it 
is unnecessary to publish a notice of proposed rulemaking for these 
final rules. Accordingly, the RFA's requirements relating to an initial 
and final regulatory flexibility analysis do not apply.

Unfunded Mandates Reform Act of 1995

    Section 202 of the Unfunded Mandates Reform Act of 1995, Public Law 
104-4 (UMRA), requires that an agency prepare a budgetary impact 
statement before promulgating a rule that includes a Federal mandate 
that may result in the expenditure by State, local, and tribal 
governments, in the aggregate, or by the private sector of $100 million 
or more (adjusted annually for inflation) in any one year. The 
inflation adjusted threshold is $133 million or more. If a budgetary 
impact statement is required, section 205 of the UMRA also requires an 
agency to identify and consider a reasonable number of regulatory 
alternatives before promulgating a rule. The OCC and OTS have each 
determined that their respective portions of these final rules will not 
result in expenditures by State, local, and tribal governments, in the 
aggregate, or by the private sector, of $133 million or more in any one 
year. Accordingly, these final rules are not subject to section 202 of 
the UMRA.

Executive Order 13132

    The OCC and OTS have each determined that their respective portions 
of these final rules do not have any Federalism implications as 
required by Executive Order 13132.
    Executive Order 13132 encourages independent regulatory agencies to 
consider the impact of their actions on state and local interests. NCUA 
voluntarily complies with the Executive Order and has determined that 
the final rules do not have federalism implications for purposes of the 
Executive Order.

NCUA: Small Business Regulatory Enforcement Fairness Act of 1996 
(SBREFA)

    The SBREFA does not apply to a rulemaking where a final regulatory 
flexibility analysis under section 604 of title 5, United States Code 
is not required. 5 U.S.C. 601 note. As noted above, the Agencies have 
determined the requirements for a final regulatory flexibility analysis 
do not apply. Accordingly, no SBREFA reporting requirement is required.

NCUA: The Treasury and General Government Appropriations Act, 1999--
Assessment of Federal Regulations and Policies on Families

    NCUA has determined that this rule would not affect family well-
being within the meaning of section 654 of the Treasury and General 
Government Appropriations Act, 1999, Pub. L. 105-277, 112 Stat. 2681 
(1998).

List of Subjects

12 CFR Part 41

    Banks, Banking, Consumer protection, National banks, Reporting and 
recordkeeping requirements.

12 CFR Part 222

    Banks, Banking, Consumer protection, Fair Credit Reporting Act, 
Holding companies, Privacy, Reporting and recordkeeping requirements, 
State member banks.

12 CFR Part 334

    Administrative practice and procedure, Bank deposit insurance, 
Banks, Banking, Reporting and recordkeeping requirements, Safety and 
soundness.

12 CFR Part 571

    Consumer protection, Credit, Fair Credit Reporting Act, Privacy, 
Reporting and recordkeeping requirements, Savings associations.

12 CFR Part 717

    Consumer protection, Credit unions, Fair credit reporting, Privacy, 
Reporting and recordkeeping requirements.

16 CFR Part 641

    Consumer reports, Users of consumer reports, Consumer reporting 
agencies, Information furnishers.

[[Page 22642]]

16 CFR Part 681

    Fair Credit Reporting Act, Consumer reports, Consumer reporting 
agencies, Credit, Creditors, Information furnishers, Identity theft, 
Trade practices.

16 CFR Part 698

    Consumer reports, Consumer reporting agencies, Credit, Fair Credit 
Reporting Act, Trade practices.

Title 12

Department of the Treasury

Office of the Comptroller of the Currency

0
For the reasons set forth in the preamble, 12 CFR part 41 is amended as 
follows:

PART 41--FAIR CREDIT REPORTING

0
1. The authority citation for part 41 continues to read as follows:

    Authority: 12 U.S.C. 1 et seq., 24 (Seventh), 93a, 481, 484, and 
1818; 15 U.S.C. 1681a, 1681b, 1681c, 1681m, 1681s, 1681s-3, 1681t, 
1681w, 6801, and 6805; Sec. 214, Public Law 108-159, 117 Stat. 1952.


Sec.  41.82  [Amended]

0
2. Section 41.82 is amended by:
0
a. Adding in paragraph (a) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)'';
0
b. Adding in paragraph (b) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)'';
0
c. Removing in paragraph (c)(2)(i)(A) the phrase ``Customer Information 
Program'' and adding in its place the phrase ``Customer Identification 
Program'';
0
d. Adding in paragraph (d)(1) introductory text after the second 
occurrence of the phrase ``consumer reporting agency'' the phrase 
``described in 15 U.S.C. 1681a(p)''; and
0
e. Adding in paragraph (d)(3) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)''.

0
3. Appendix C to Part 41 is amended by:
0
a. Redesignating Model Form C-5 as Model Form C-6; and
0
b. Adding new paragraph b.10 and new Model Form C-5 to read as follows:

Appendix C to Part 41--Model Forms for Opt-Out Notices

* * * * *
    b. * * *
    10. Adding disclosures regarding the treatment of opt-outs by 
joint consumers to comply with Sec.  41.23(a)(2) of this part.
* * * * *

C-5--Model Form for Voluntary ``No Marketing'' Notice

Your Choice To Stop Marketing

 [Name of Affiliate] is providing this notice.
 You may choose to stop all marketing from us and our 
affiliates.
 [Your choice to stop marketing from us and our affiliates 
will apply until you tell us to change your choice.]
To stop all marketing, contact us [include all that apply]:
     By telephone: 1-877--

     On the Web: www._.com
     By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]
--Do not market to me.
* * * * *

Appendix C to Part 41 [Amended]

0
4. Effective January 1, 2010, remove newly redesignated Model Form C-6.

Appendix J to Part 41, Supplement A [Amended]

0
5. Appendix J to Part 41, Supplement A, is amended by:
0
a. Removing in paragraph 15 the phrase ``account number'' and adding in 
its place the word ``address'';
0
b. Removing in paragraph 15 the phrase ``other customers'' and adding 
in its place the phrase ``by other customers''; and
0
c. Removing in paragraph 20 introductory text the phrase ``patterns of 
fraud patterns'' and adding in its place the phrase ``patterns of 
fraud''.

Board of Governors of the Federal Reserve System

0
For the reasons set forth in the preamble, 12 CFR part 222 is amended 
as follows:

PART 222--FAIR CREDIT REPORTING (REGULATION V)

0
6. The authority citation for part 222 continues to read as follows:

    Authority: 15 U.S.C. 1681a, 1681b, 1681c, 1681m, 1681s, 1681s-2, 
1681s-3, 1681t, and 1681w; Secs. 3 and 214, Pub. L. 108-159, 117 
Stat. 1952.


Sec.  222.82  [Amended]

0
7. Section 222.82 is amended by:
0
a. Adding in paragraph (a) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)'';
0
b. Adding in paragraph (b) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)'';
0
c. Removing in paragraph (c)(2)(i)(A) the phrase ``Customer Information 
Program'' and adding in its place the phrase ``Customer Identification 
Program'';
0
d. Adding in paragraph (d)(1) introductory text after the second 
occurrence of the phrase ``consumer reporting agency'' the phrase 
``described in 15 U.S.C. 1681a(p)''; and
0
e. Adding in paragraph (d)(3) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)''.


Sec.  222.90  [Amended]

0
8. Section 222.90(a) is amended by adding after the phrase ``and their 
respective operating subsidiaries'' the phrase ``that are not 
functionally regulated within the meaning of section 5(c)(5) of the 
Bank Holding Company Act, as amended (12 U.S.C. 1844(c)(5))''.

0
9. Appendix C to Part 222 is amended by:
0
a. Redesignating Model Form C-5 as Model Form C-6; and
0
b. Adding new paragraph b.10 and new Model Form C-5 to read as follows:

Appendix C to Part 222--Model Forms for Opt-Out Notices

    b. * * *
    10. Adding disclosures regarding the treatment of opt-outs by 
joint consumers to comply with Sec.  222.23(a)(2) of this part.
* * * * *

C-5--Model Form for Voluntary ``No Marketing'' Notice

Your Choice To Stop Marketing

 [Name of Affiliate] is providing this notice.
 You may choose to stop all marketing from us and our 
affiliates.
 [Your choice to stop marketing from us and our affiliates 
will apply until you tell us to change your choice.]
To stop all marketing, contact us [include all that apply]:
     By telephone: 1-877--

     On the Web: www._.com
     By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]
--Do not market to me.
* * * * *

Appendix C to Part 222 [Amended]

0
10. Effective January 1, 2010, remove newly redesignated Model Form C-
6.

Appendix J to Part 222, Supplement A [Amended]

0
11. Appendix J to Part 222, Supplement A, is amended by:
0
a. Removing in paragraph 15 the phrase ``account number'' and adding in 
its place the word ``address'';
0
b. Removing in paragraph 15 the phrase ``other customers'' and adding 
in its place the phrase ``by other customers''; and

[[Page 22643]]

0
c. Removing in paragraph 20 the phrase ``patterns of fraud patterns'' 
and adding in its place the phrase ``patterns of fraud''

Federal Deposit Insurance Corporation

0
For the reasons set forth in the preamble, 12 CFR part 334 is amended 
as follows:

PART 334--FAIR CREDIT REPORTING

0
12. The authority citation for part 334 continues to read as follows:

    Authority: 12 U.S.C. 1818, 1819 (Tenth) and 1831p-1; 15 U.S.C. 
1681a, 1681b, 1681c, 1681m, 1681s, 1681s-3, 1681t, 1681w, 6801 and 
6805, Public Law 108-159, 117 Stat. 1952.


Sec.  334.82  [Amended]

0
13. Section 334.82 is amended by:
0
a. Adding in paragraph (a) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)'';
0
b. Adding in paragraph (b) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)'';
0
c. Removing in paragraph (c)(2)(i)(A) the phrase ``Customer Information 
Program'' and adding in its place the phrase ``Customer Identification 
Program'';
0
d. Adding in paragraph (d)(1) introductory text after the second 
occurrence of the phrase ``consumer reporting agency'' the phrase 
``described in 15 U.S.C. 1681a(p)''; and
0
e. Adding in paragraph (d)(3) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)''.

0
14. Appendix C to Part 334 is amended by:
0
a. Redesignating Model Form C-5 as Model Form C-6; and
0
b. Adding new paragraph b.10 and new Model Form C-5 to read as follows:

Appendix C to Part 334--Model Forms for Opt-Out Notices

* * * * *
    b.* * *
    10. Adding disclosures regarding the treatment of opt-outs by 
joint consumers to comply with Sec.  334.23(a)(2) of this part.
* * * * *

C-5--Model Form for Voluntary ``No Marketing'' Notice

Your Choice To Stop Marketing

 [Name of Affiliate] is providing this notice.
 You may choose to stop all marketing from us and our 
affiliates.
 [Your choice to stop marketing from us and our affiliates 
will apply until you tell us to change your choice.]
To stop all marketing, contact us [include all that apply]:
     By telephone: 1-877--

     On the Web: www._.com
     By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]
--Do not market to me.
* * * * *

Appendix C to Part 334 [Amended]

0
15. Effective January 1, 2010, remove newly redesignated Model Form C-
6.

Appendix J to Part 334, Supplement A [Amended]

0
16. Appendix J to Part 334, Supplement A, is amended by:
0
a. Removing in paragraph 15 the phrase ``account number'' and adding in 
its place the word ``address'';
0
b. Removing in paragraph 15 the phrase ``other customers'' and adding 
in its place the phrase ``by other customers''; and
0
c. Removing in paragraph 20 the phrase ``patterns of fraud patterns'' 
and adding in its place the phrase ``patterns of fraud''.

Department of the Treasury

Office of Thrift Supervision

0
For the reasons set forth in the preamble, 12 CFR part 571 is amended 
as follows:

PART 571--FAIR CREDIT REPORTING

0
17. The authority citation for part 571 continues to read as follows:

    Authority: 12 U.S.C. 1462a, 1463, 1464, 1467a, 1828, 1831p-1, 
and 1881-1884; 15 U.S.C. 1681b, 1681c, 1681m, 1681s, 1681s-1, 1681t 
and 1681w; 15 U.S.C. 6801 and 6805; Sec. 214 Pub. L. 108-159, 117 
Stat. 1952.


Sec.  571.82   [Amended]

0
18. Section 571.82 is amended by:
0
a. Adding in paragraph (a) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)'';
0
b. Adding in paragraph (b) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)'';
0
c. Removing in paragraph (c)(2)(i)(A) the phrase ``Customer Information 
Program'' and adding in its place the phrase ``Customer Identification 
Program'';
0
d. Adding in paragraph (d)(1) introductory text after the second 
occurrence of the phrase ``consumer reporting agency'' the phrase 
``described in 15 U.S.C. 1681a(p)''; and
0
e. Adding in paragraph (d)(3) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)''.
0
19. Appendix C to Part 571 is amended by:
0
a. Redesignating Model Form C-5 as Model Form C-6; and
0
b. Adding new paragraph b.10 and new Model Form C-5 to read as follows:

Appendix C to Part 571--Model Forms for Opt-Out Notices

* * * * *
    b.* * *
    10. Adding disclosures regarding the treatment of opt-outs by 
joint consumers to comply with Sec.  571.23(a)(2) of this part.
* * * * *

C-5--Model Form for Voluntary ``No Marketing'' Notice

Your Choice To Stop Marketing

 [Name of Affiliate] is providing this notice.
 You may choose to stop all marketing from us and our 
affiliates.
 [Your choice to stop marketing from us and our affiliates 
will apply until you tell us to change your choice.]
To stop all marketing, contact us [include all that apply]:
     By telephone: 1-877--

     On the Web: www.-.com
     By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]
--Do not market to me.
* * * * *

Appendix C to Part 571 [Amended]

0
20. Effective January 1, 2010, remove newly redesignated Model Form C-
6.

Appendix J to Part 571, Supplement A [Amended]

0
21. Appendix J to Part 571, Supplement A, is amended by:
0
a. Removing in paragraph 15 the phrase ``account number'' and adding in 
its place the word ``address'';
0
b. Removing in paragraph 15 the phrase ``other customers'' and adding 
in its place the phrase ``by other customers''; and
0
c. Removing in paragraph 20 the phrase ``patterns of fraud patterns'' 
and adding in its place the phrase ``patterns of fraud''.

National Credit Union Administration

0
For the reasons set forth in the preamble, 12 CFR part 717 is amended 
as follows:

PART 717--FAIR CREDIT REPORTING

0
22. The authority citation for part 717 continues to read as follows:

    Authority: 12 U.S.C. 1751 et seq.; 15 U.S.C. 1681a, 1681b, 
1681c, 1681m, 1681s, 1681s-1, 1681t, 1681w, 6801 and 6805, Public 
Law 108-159, 117 Stat. 1952.

[[Page 22644]]

Subpart I--Duties of Users of Consumer Reports Regarding Address 
Discrepancies and Records Disposal


Sec.  717.82   [Amended]

0
23. Section 717.82 is amended by:
0
a. Adding in paragraph (a) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)'';
0
b. Adding in paragraph (b) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)'';
0
c. Removing in paragraph (c)(2)(i)(A) the phrase ``Customer Information 
Program'' and adding in its place the phrase ``Customer Identification 
Program'';
0
d. Adding in paragraph (d)(1) introductory text after the second 
occurrence of the phrase ``consumer reporting agency'' the phrase 
``described in 15 U.S.C. 1681a(p)''; and
0
e. Adding in paragraph (d)(3) after the phrase ``consumer reporting 
agency'' the phrase ``described in 15 U.S.C. 1681a(p)''.

0
24. The heading for Sec.  717.91 is revised to read as follows:


Sec.  717.91   Duties of card issuers regarding changes of address.

* * * * *
0
25. Appendix C to Part 717 is amended by:
0
a. Redesignating Model Form C-5 as Model Form C-6; and
0
b. Adding new paragraph b.10 and new Model Form C-5 to read as follows:

Appendix C to Part 717--Model Forms for Opt-Out Notices

* * * * *b. * * *
    10. Adding disclosures regarding the treatment of opt-outs by 
joint consumers to comply with Sec.  717.23(a)(2) of this part.
* * * * *

C-5--Model Form for Voluntary ``No Marketing'' Notice

Your Choice To Stop Marketing

 [Name of Affiliate] is providing this notice.
 You may choose to stop all marketing from us and our 
affiliates.
 [Your choice to stop marketing from us and our affiliates 
will apply until you tell us to change your choice.]
To stop all marketing, contact us [include all that apply]:
     By telephone: 1-877--

     On the Web: www._.com
     By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]
--Do not market to me.
* * * * *

Appendix C to Part 717 [Amended]

0
26. Effective January 1, 2010, remove newly redesignated Model Form C-
6.

Appendix J to Part 717, Supplement A [Amended]

0
27. Appendix J to Part 717, Supplement A, is amended by:
0
a. Removing in paragraph 15 the phrase ``account number'' and adding in 
its place the word ``address'';
0
b. Removing in paragraph 15 the phrase ``other members'' and adding in 
its place the phrase ``by other members''; and
0
c. Removing in paragraph 20 the phrase ``patterns of fraud patterns'' 
and adding in its place the phrase ``patterns of fraud''.

Title 16

Federal Trade Commission

0
For the reasons set forth in the preamble, 16 CFR chapter I is amended 
as follows:
0
28. Add a new part 641 to read as follows:

PART 641--DUTIES OF USERS OF CONSUMER REPORTS REGARDING ADDRESS 
DISCREPANCIES

Sec.
641.1 Duties of users of consumer reports regarding address 
discrepancies.

    Authority: Public Law 108-159, sec. 315; 15 U.S.C. 1681c(h).


Sec.  641.1  Duties of users of consumer reports regarding address 
discrepancies.

    (a) Scope. This section applies to users of consumer reports that 
are subject to administrative enforcement of the FCRA by the Federal 
Trade Commission pursuant to 15 U.S.C. 1681s(a)(1) (users).
    (b) Definition. For purposes of this section, a notice of address 
discrepancy means a notice sent to a user by a consumer reporting 
agency described in 15 U.S.C. 1681a(p) pursuant to 15 U.S.C. 
1681c(h)(1), that informs the user of a substantial difference between 
the address for the consumer that the user provided to request the 
consumer report and the address(es) in the agency's file for the 
consumer.
    (c) Reasonable belief--(1) Requirement to form a reasonable belief. 
A user must develop and implement reasonable policies and procedures 
designed to enable the user to form a reasonable belief that a consumer 
report relates to the consumer about whom it has requested the report, 
when the user receives a notice of address discrepancy.
    (2) Examples of reasonable policies and procedures. (i) Comparing 
the information in the consumer report provided by the consumer 
reporting agency with information the user:
    (A) Obtains and uses to verify the consumer's identity in 
accordance with the requirements of the Customer Identification Program 
(CIP) rules implementing 31 U.S.C. 5318(l) (31 CFR 103.121);
    (B) Maintains in its own records, such as applications, change of 
address notifications, other customer account records, or retained CIP 
documentation; or
    (C) Obtains from third-party sources; or
    (ii) Verifying the information in the consumer report provided by 
the consumer reporting agency with the consumer.
    (d) Consumer's address--(1) Requirement to furnish consumer's 
address to a consumer reporting agency. A user must develop and 
implement reasonable policies and procedures for furnishing an address 
for the consumer that the user has reasonably confirmed is accurate to 
the consumer reporting agency described in 15 U.S.C. 1681a(p) from whom 
it received the notice of address discrepancy when the user:
    (i) Can form a reasonable belief that the consumer report relates 
to the consumer about whom the user requested the report;
    (ii) Establishes a continuing relationship with the consumer; and
    (iii) Regularly and in the ordinary course of business furnishes 
information to the consumer reporting agency from which the notice of 
address discrepancy relating to the consumer was obtained.
    (2) Examples of confirmation methods. The user may reasonably 
confirm an address is accurate by:
    (i) Verifying the address with the consumer about whom it has 
requested the report;
    (ii) Reviewing its own records to verify the address of the 
consumer;
    (iii) Verifying the address through third-party sources; or
    (iv) Using other reasonable means.
    (3) Timing. The policies and procedures developed in accordance 
with paragraph (d)(1) of this section must provide that the user will 
furnish the consumer's address that the user has reasonably confirmed 
is accurate to the consumer reporting agency described in 15 U.S.C. 
1681a(p) as part of the information it regularly furnishes for the 
reporting period in which it establishes a relationship with the 
consumer.

PART 681--IDENTITY THEFT RULES

0
29. The authority citation for part 681 is revised to read as follows:


[[Page 22645]]


    Authority: Public Law 108-159, sec. 114; 15 U.S.C. 1681m(e).


0
30. Revise Sec. Sec.  681.1 and 681.2 to read as follows:


Sec.  681.1  Duties regarding the detection, prevention, and mitigation 
of identity theft.

    (a) Scope. This section applies to financial institutions and 
creditors that are subject to administrative enforcement of the FCRA by 
the Federal Trade Commission pursuant to 15 U.S.C. 1681s(a)(1).
    (b) Definitions. For purposes of this section, and Appendix A, the 
following definitions apply:
    (1) Account means a continuing relationship established by a person 
with a financial institution or creditor to obtain a product or service 
for personal, family, household or business purposes. Account includes:
    (i) An extension of credit, such as the purchase of property or 
services involving a deferred payment; and
    (ii) A deposit account.
    (2) The term board of directors includes:
    (i) In the case of a branch or agency of a foreign bank, the 
managing official in charge of the branch or agency; and
    (ii) In the case of any other creditor that does not have a board 
of directors, a designated employee at the level of senior management.
    (3) Covered account means:
    (i) An account that a financial institution or creditor offers or 
maintains, primarily for personal, family, or household purposes, that 
involves or is designed to permit multiple payments or transactions, 
such as a credit card account, mortgage loan, automobile loan, margin 
account, cell phone account, utility account, checking account, or 
savings account; and
    (ii) Any other account that the financial institution or creditor 
offers or maintains for which there is a reasonably foreseeable risk to 
customers or to the safety and soundness of the financial institution 
or creditor from identity theft, including financial, operational, 
compliance, reputation, or litigation risks.
    (4) Credit has the same meaning as in 15 U.S.C. 1681a(r)(5).
    (5) Creditor has the same meaning as in 15 U.S.C. 1681a(r)(5), and 
includes lenders such as banks, finance companies, automobile dealers, 
mortgage brokers, utility companies, and telecommunications companies.
    (6) Customer means a person that has a covered account with a 
financial institution or creditor.
    (7) Financial institution has the same meaning as in 15 U.S.C. 
1681a(t).
    (8) Identity theft has the same meaning as in 16 CFR 603.2(a).
    (9) Red Flag means a pattern, practice, or specific activity that 
indicates the possible existence of identity theft.
    (10) Service provider means a person that provides a service 
directly to the financial institution or creditor.
    (c) Periodic Identification of Covered Accounts. Each financial 
institution or creditor must periodically determine whether it offers 
or maintains covered accounts. As a part of this determination, a 
financial institution or creditor must conduct a risk assessment to 
determine whether it offers or maintains covered accounts described in 
paragraph (b)(3)(ii) of this section, taking into consideration:
    (1) The methods it provides to open its accounts;
    (2) The methods it provides to access its accounts; and
    (3) Its previous experiences with identity theft.
    (d) Establishment of an Identity Theft Prevention Program--(1) 
Program requirement. Each financial institution or creditor that offers 
or maintains one or more covered accounts must develop and implement a 
written Identity Theft Prevention Program (Program) that is designed to 
detect, prevent, and mitigate identity theft in connection with the 
opening of a covered account or any existing covered account. The 
Program must be appropriate to the size and complexity of the financial 
institution or creditor and the nature and scope of its activities.
    (2) Elements of the Program. The Program must include reasonable 
policies and procedures to:
    (i) Identify relevant Red Flags for the covered accounts that the 
financial institution or creditor offers or maintains, and incorporate 
those Red Flags into its Program;
    (ii) Detect Red Flags that have been incorporated into the Program 
of the financial institution or creditor;
    (iii) Respond appropriately to any Red Flags that are detected 
pursuant to paragraph (d)(2)(ii) of this section to prevent and 
mitigate identity theft; and
    (iv) Ensure the Program (including the Red Flags determined to be 
relevant) is updated periodically, to reflect changes in risks to 
customers and to the safety and soundness of the financial institution 
or creditor from identity theft.
    (e) Administration of the Program. Each financial institution or 
creditor that is required to implement a Program must provide for the 
continued administration of the Program and must:
    (1) Obtain approval of the initial written Program from either its 
board of directors or an appropriate committee of the board of 
directors;
    (2) Involve the board of directors, an appropriate committee 
thereof, or a designated employee at the level of senior management in 
the oversight, development, implementation and administration of the 
Program;
    (3) Train staff, as necessary, to effectively implement the 
Program; and
    (4) Exercise appropriate and effective oversight of service 
provider arrangements.
    (f) Guidelines. Each financial institution or creditor that is 
required to implement a Program must consider the guidelines in 
appendix A of this part and include in its Program those guidelines 
that are appropriate.


Sec.  681.2  Duties of card issuers regarding changes of address.

    (a) Scope. This section applies to a person described in Sec.  
681.1(a) that issues a debit or credit card (card issuer).
    (b) Definitions. For purposes of this section:
    (1) Cardholder means a consumer who has been issued a credit or 
debit card.
    (2) Clear and conspicuous means reasonably understandable and 
designed to call attention to the nature and significance of the 
information presented.
    (c) Address validation requirements. A card issuer must establish 
and implement reasonable policies and procedures to assess the validity 
of a change of address if it receives notification of a change of 
address for a consumer's debit or credit card account and, within a 
short period of time afterwards (during at least the first 30 days 
after it receives such notification), the card issuer receives a 
request for an additional or replacement card for the same account. 
Under these circumstances, the card issuer may not issue an additional 
or replacement card, until, in accordance with its reasonable policies 
and procedures and for the purpose of assessing the validity of the 
change of address, the card issuer:
    (1)(i) Notifies the cardholder of the request:
    (A) At the cardholder's former address; or
    (B) By any other means of communication that the card issuer and 
the cardholder have previously agreed to use; and
    (ii) Provides to the cardholder a reasonable means of promptly 
reporting incorrect address changes; or
    (2) Otherwise assesses the validity of the change of address in 
accordance with the policies and procedures the

[[Page 22646]]

card issuer has established pursuant to Sec.  681.1 of this part.
    (d) Alternative timing of address validation. A card issuer may 
satisfy the requirements of paragraph (c) of this section if it 
validates an address pursuant to the methods in paragraph (c)(1) or 
(c)(2) of this section when it receives an address change notification, 
before it receives a request for an additional or replacement card.
    (e) Form of notice. Any written or electronic notice that the card 
issuer provides under this paragraph must be clear and conspicuous and 
provided separately from its regular correspondence with the 
cardholder.

Sec.  681.3  [Removed]

0
31. Remove Sec.  681.3.

Appendix A to Part 681 [Amended]

0
32. Appendix A to Part 681 is amended by:
0
a. Revising the introduction;
0
b. Removing in sections VI(a)(2) and VI(b)(1) the term ``Sec.  681.2,'' 
and adding in its place the term ``Sec.  681.1'';
0
c. Removing, in Supplement A to Appendix A, in paragraph 3, the term 
``Sec.  681.1(b)'' and adding in its place the term ``Sec.  641.1(b)'';
0
d. Removing, in Supplement A to Appendix A, in paragraph 15, the phrase 
``account number'' and adding in its place the word ``address'';
0
e. Removing, in Supplement A to Appendix A, in paragraph 15, the phrase 
``other customers'' and adding in its place the phrase ``by other 
customers''; and
0
f. Removing, in Supplement A to Appendix A, in paragraph 20, the phrase 
``patterns of fraud patterns'' and adding in its place the phrase 
``patterns of fraud''.
    The revision reads as follows:

Appendix A to Part 681--Interagency Guidelines on Identity Theft 
Detection, Prevention, and Mitigation

    Section 681.1 of this part requires each financial institution 
and creditor that offers or maintains one or more covered accounts, 
as defined in Sec.  681.1(b)(3) of this part, to develop and provide 
for the continued administration of a written Program to detect, 
prevent, and mitigate identity theft in connection with the opening 
of a covered account or any existing covered account. These 
guidelines are intended to assist financial institutions and 
creditors in the formulation and maintenance of a Program that 
satisfies the requirements of Sec.  681.1 of this part.
* * * * *

PART 698--MODEL FORMS AND DISCLOSURES

0
33. The authority citation for part 698 continues to read as follows:

    Authority: 15 U.S.C. 1681e, 1681g, 1681j, 1681m, 1681s, and 
1681s-3; sections 211(d) and 214(b), Public Law 108-159, 117 
Stat.1952.


0
34. Appendix C to Part 698 is amended by:
0
a. Redesignating Model Form C-5 as Model Form C-6; and
0
b. Adding new paragraph B.10 and new Model Form C-5 to read as follows:

Appendix C to Part 698--Model Forms for Opt-Out Notices

* * * * *
    B. * * *
    10. Adding disclosures regarding the treatment of opt-outs by 
joint consumers to comply with Sec.  680.23(a)(2) of part 680.
* * * * *

C-5--Model Form for Voluntary ``No Marketing'' Notice

Your Choice To Stop Marketing

 [Name of Affiliate] is providing this notice.
 You may choose to stop all marketing from us and our 
affiliates.
 [Your choice to stop marketing from us and our affiliates 
will apply until you tell us to change your choice.]
To stop all marketing, contact us [include all that apply]:
     By telephone: 1-877--

     On the Web: www._.com
     By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]
--Do not market to me.
* * * * *

Appendix C to Part 698 [Amended]

0
35. Effective January 1, 2010, newly redesignated Model Form C-6 is 
removed.

    By order of the Board of Governors of the Federal Reserve 
System, April 27, 2009.
Jennifer J. Johnson,
Secretary of the Board.

    By the Office of the Comptroller of the Currency.
Julie L. Williams,
First Senior Deputy Comptroller and Chief Counsel.

    By order of the Board of Directors, Federal Deposit Insurance 
Corporation.
Robert E. Feldman,
Executive Secretary.

    By the Office of Thrift Supervision,
John E. Bowman,
Acting Director.

    By order of the National Credit Union Administration Board.
Mary F. Rupp,
Secretary of the Board.

    By direction of the Commission.
Donald S. Clark,
Secretary.
 [FR Doc. E9-10009 Filed 5-13-09; 8:45 am]
BILLING CODE 4810-33-P, 6210-01-P, 6714-01-P, 6720-01-P, 7535-01-P