Which statement about the Red Flags Rule is true?

• A. It is optional for all entities
• B. It applies only to financial institutions
• C. It does not require an Identity Theft Prevention Program
• D. It requires covered entities to implement an Identity Theft Prevention Program

Answer: (D)

The key idea is that the Red Flags Rule requires that entities with potential identity-theft risk have a written Identity Theft Prevention Program. This program is meant to help detect, prevent, and mitigate identity theft by identifying “red flags” of identity theft, establishing procedures to respond to those red flags, and keeping the program updated with training and adjustments as needed. Because of this, the statement that is true is that covered entities must implement an Identity Theft Prevention Program. It’s not optional, and it isn’t limited only to financial institutions—it also applies to creditors that offer or maintain certain covered accounts. That’s why the other options don’t fit: it’s not optional for all entities; it doesn’t apply solely to financial institutions; and it does require an Identity Theft Prevention Program.