Within FACT Act compliance, what is the purpose of the Red Flags Rule?

• A. To regulate data encryption standards.
• B. To require identification and response to identity theft red flags.
• C. To restrict the sharing of information with affiliates.
• D. To mandate breach notification timelines.

Answer: (B)

The Red Flags Rule focuses on preventing identity theft by requiring entities to identify and respond to signals that someone may be using another person’s information. Covered institutions must have a written Identity Theft Prevention Program that regularly looks for red flags—patterns, practices, or suspicious activities—associated with identity theft and outlines steps to respond, such as additional verification, freezing or monitoring accounts, or notifying the affected person. This rule is about detection and proactive response to potential identity theft, not about encryption standards, affiliate data sharing restrictions, or breach notification timelines, which fall under different requirements.