Are FACT Act provisions applicable to small businesses?

• A. All provisions apply to all small businesses.
• B. No provisions apply to small businesses.
• C. Some provisions apply to creditors with covered accounts; applicability depends on activities and status.
• D. Only non-financial entities are exempt.

Answer: (C)

Not all FACT Act requirements apply to every business. The reach of the Act depends on what the entity does and its status as a creditor or data handler. Some provisions, like the Red Flags Rule on identity theft prevention, only kick in for creditors that maintain covered accounts—meaning they regularly extend or allow credit and keep consumer accounts. If a small business offers consumer credit or maintains consumer accounts, it must implement an identity theft prevention program and monitor for red flags. If a small business does not extend consumer credit and does not maintain such accounts, that rule won’t apply.

Other parts of the Act can apply if the business handles consumer reports or sensitive consumer information, but those obligations hinge on whether the business actually uses or stores such information. So the correct view is that some provisions apply to creditors with covered accounts, and applicability depends on the business’s activities and status.