ESTABLISHMENT OF PROCEDURES FOR THE IDENTIFICATION OF POSSIBLE INSTANCES OF IDENTITY THEFT.

SEC. 114. ESTABLISHMENT OF PROCEDURES FOR THE IDENTIFICATION OF POSSIBLE INSTANCES OF IDENTITY THEFT. Section 615 of the Fair Credit Reporting Act (15 U.S.C. 1681m) is amended—(1) by striking “(e)” at the end; and (2) by adding at the end the following:“(e) Red Flag Guidelines and Regulations Required.—“(1) Guidelines.—The Federal banking agencies, the National Credit Union Administration, and the Commission shall jointly, with respect to the entities that are subject to their respective enforcement authority under section 621—“(A) establish and maintain guidelines for use by each financial institution and each creditor regarding identity theft with respect to account holders at, or customers of, such entities, and update such guidelines as often as necessary;“(B) prescribe regulations requiring each financial institution and each creditor to establish reasonable policies and procedures for implementing the guidelines established pursuant to subparagraph (A), to identify possible risks to account holders or customers or to the safety and soundness of the institution or customers; and“(C) prescribe regulations applicable to card issuers to ensure that, if a card issuer receives notification of a change of address for an existing account, and within a short period of time (during at least the first 30 days after such notification is received) receives a request for an additional or replacement card for the same account, the card issuer may not issue the additional or replacement card, unless the card issuer, in accordance with reasonable policies and procedures—“(i) notifies the cardholder of the request at the former address of the cardholder and provides to the cardholder a means of promptly reporting incorrect address changes; “(ii) notifies the cardholder of the request by such other means of communication as the cardholder and the card issuer previously agreed to; or “(iii) uses other means of assessing the validity of the change of address, in accordance with reasonable policies and procedures established by the card issuer in accordance with the regulations prescribed under subparagraph (B).“(2) Criteria.—“(A) In general.—In developing the guidelines required by paragraph (1)(A), the agencies described in paragraph (1) shall identify patterns, practices, and specific forms of activity that indicate the possible existence of identity theft.“(B) Inactive accounts.—In developing the guidelines required by paragraph (1)(A), the agencies described in paragraph (1) shall consider including reasonable guidelines providing that when a transaction occurs with respect 117 STAT. 1961 to a credit or deposit account that has been inactive for more than 2 years, the creditor or financial institution shall follow reasonable policies and procedures that provide for notice to be given to a consumer in a manner reasonably designed to reduce the likelihood of identity theft with respect to such account.“(3) Consistency with verification requirements.—Guidelines established pursuant to paragraph (1) shall not be inconsistent with the policies and procedures required under section 5318(l) of title 31, United States Code.”.