The red flags rule in banking is the federal Identity Theft Red Flags Rule as it applies to banks: each bank that offers or maintains covered accounts, which includes every consumer checking and savings account, must "develop and implement a written Identity Theft Prevention Program" designed to detect, prevent and mitigate identity theft "in connection with the opening of a covered account or any existing covered account" (12 CFR 41.90(d)(1)). The program must identify the red flags relevant to the bank, detect them, respond to them and be kept up to date, and the board or a committee of it must approve it. It is a program rule rather than a checklist: the agencies judge whether it works. The daily work of detecting and responding to red flags on new accounts is what Botminds' New Account Fraud Detection is built for.
The red flags rule in banking, element by element, and the daily work behind each
| What the rule requires | Where it is written | What it means on a new account fraud desk |
|---|---|---|
| Identify relevant red flags | 12 CFR 41.90(d)(2)(i) | Choose the signs that matter for your channels: partner apps, branches, online opening |
| Detect them | 41.90(d)(2)(ii) | Watch opening files and the account’s first weeks for those signs, every day |
| Respond appropriately | 41.90(d)(2)(iii) | Restrict, close, contact the customer or decide no response is warranted, with a reason |
| Update periodically | 41.90(d)(2)(iv) | Change the flags and settings when fraud, channels or partners change |
| Board approval of the initial program | 41.90(e)(1) | A document the board or a committee approved, and material changes after |
| Senior oversight | 41.90(e)(2) | A named owner who receives the fraud team’s reports |
| Training as necessary | 41.90(e)(3) | Staff who open, service or review accounts know the flags and the responses |
| Oversee service providers | 41.90(e)(4) | Partners and vendors who open or service accounts are held to the program |
What is the red flags rule in banking?
It is a regulation issued under the Fair Credit Reporting Act, as amended by the FACT Act of 2003, which told the federal banking agencies, the NCUA, the FTC, the CFTC and the SEC to jointly "establish and maintain guidelines for use by each financial institution and each creditor regarding identity theft" and to require "reasonable policies and procedures for implementing the guidelines" (15 U.S.C. 1681m(e)). The agencies issued it together in November 2007, with interagency guidelines and a supplement of example red flags.
A red flag, in the rule's own words, is "a pattern, practice, or specific activity that indicates the possible existence of identity theft". Identity theft is defined broadly. The agencies' 2009 FAQs explain that "the creation of a fictitious identity using any single piece of information belonging to a real person, such as check forgery or the use of a stolen credit card, falls within the definition" (Frequently Asked Questions: Identity Theft Red Flags and Address Discrepancies, 2009). That sentence is the reason a synthetic identity that borrows one real person's Social Security number is inside the rule, not beside it; Synthetic Identity Fraud Detection covers that work in lending.
The same 2007 package contains two smaller rules banks also follow: an address discrepancy rule for users of consumer reports, and a card issuer rule that stops a bank from issuing an additional or replacement debit or credit card soon after a change of address until it has assessed the change, for "at least the first 30 days" after the notice (12 CFR 41.91(c)).
Which accounts does it cover? Every checking account, and possibly more
A covered account has two parts. The first is automatic: an account "primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, such as a credit card account, mortgage loan, automobile loan, margin account, cell phone account, utility account, checking account, or savings account". The second is a judgment: "Any other account" with "a reasonably foreseeable risk to customers or to the safety and soundness" of the bank from identity theft (12 CFR 41.90(b)(3)). Business accounts fall under the second. The FAQs warn that "the accounts of small businesses or sole proprietorships may be particularly vulnerable to identity theft".
The periodic risk assessment that decides which other accounts are covered
- The methods the bank provides to open its accounts
Branch, online, mobile, and every fintech partner’s app. A new channel is a new answer.
- The methods it provides to access them
Online banking, mobile, call centre, debit cards, P2P. Each is a route for a thief.
- Its previous experiences with identity theft
The accounts actually closed or restricted for identity theft, by product and channel.
For a new account fraud team the practical answer is simple: every consumer deposit account is covered from the moment it opens, and the risk assessment should be redone whenever the bank adds an opening channel. A sponsor bank that signs a new fintech partner has changed the ways it lets customers open accounts, one of the risk factors the guidelines tell it to weigh.
The four elements, read as a fraud team's daily work
Read quickly, the four elements look like a policy outline. Read as work, they describe a desk. Identifying flags is choosing what to look at; detecting them is looking, every day; responding is deciding, account by account; updating is learning from what was decided. The guidelines' section on detection makes the split between new and existing accounts explicit: for opening, "Obtaining identifying information about, and verifying the identity of, a person opening a covered account"; for existing accounts, "Authenticating customers, monitoring transactions, and verifying the validity of change of address requests" (Appendix J to 12 CFR part 41, section III).
The space between those two sentences is where new account fraud lives. An account opened yesterday is an existing account today, and the stolen-identity, mule and bust-out accounts that pass the opening check show themselves in the "monitoring transactions" half, usually within weeks. That is why the team that watches new accounts, not the team that writes the policy, does most of the program's detecting and responding.
"Just getting something down on paper won't reduce the risk of identity theft."
FTC, Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business
What are the identity theft red flag categories?
Five, set out in the interagency guidelines: "Alerts, notifications, or other warnings received from consumer reporting agencies or service providers, such as fraud detection services"; "The presentation of suspicious documents"; "The presentation of suspicious personal identifying information, such as a suspicious address change"; "The unusual use of, or other suspicious activity related to, a covered account"; and "Notice from customers, victims of identity theft, law enforcement authorities, or other persons" (Appendix J, section II(c)). Supplement A gives 26 numbered examples across them.
The examples are optional. The FAQs say a bank "may" consider them, that it "may find that none or only some of these examples are relevant to its business", and that compliance "will be determined based on the overall effectiveness of its Program", not on which examples it adopted. The categories are a map, and the fourth, unusual use of the account, is the one a deposit fraud team spends its days in. Which examples matter in which week of an account's life is set out on its own page.
A red flags checklist and a red flags program, side by side
A checklist: Copies all 26 examples into a policy.
A program: Chooses the ones that fit the bank’s channels, adds its own from its fraud cases.
A checklist: Says only that staff should be alert.
A program: Names who looks at what, when, with which data, and keeps the evidence.
A checklist: Lists possible responses.
A program: Ties each flag or combination to a response, with reason codes and a second person.
A checklist: Re-approved each year unchanged.
A program: Changed when fraud cases, channels or partners change, and the change is recorded.
A checklist: The policy document.
A program: Decisions, reasons and outcomes that show the program worked.
Does the red flags rule require automated detection?
No. The FAQs answer it directly: "The final Red Flags Rules do not require the use of any specific technology, systems, processes, or methodology." Banks "may use automated solutions if they effectively detect red flags", and the agencies add a caution: an automated system "may have to be supplemented by other policies and procedures that do not rely upon automation", for example where "the detection of fraudulent or altered identifying documentation may require the manual review of those documents by employees".
That caution is the design brief for any automated new account fraud tool. In the solution, agents read the opening file, the account's events and its links, and propose a response with reasons; a fraud analyst decides and a second person checks every restriction. The rule asks for appropriate responses; it does not ask the bank to hand the response to a machine, and a bank that did would struggle to show it was appropriate.
Results for the fraud committee: the kind of report a program owner reads
Does the red flags rule require training?
Yes, but only as needed. The rule requires a bank to "Train staff, as necessary, to effectively implement the Program" (12 CFR 41.90(e)(3)), and sets no frequency. The FTC's guide puts it plainly: "The Rule requires that you train relevant staff only as “necessary.”" (FTC). The test an examiner will apply is practical: can the people who open accounts, answer the phone and review new accounts recognise the bank's chosen flags and say what the response is? Annual training is common practice, not a rule requirement, and training that predates a new partner channel is unlikely to be enough.
Where the red flags rule meets the anti-money-laundering rules
The two sets of rules overlap on every new account, and a program should say where. The customer identification program, under the Bank Secrecy Act, governs how identity is collected and verified at opening; the Red Flags guidelines point to it as the opening-day detection step. The customer due diligence rule then requires "Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile" (31 CFR 1020.210(a)(2)(v)(A)), which is exactly the stated occupation, expected activity and purpose a new account fraud team later compares the account against. And the guidelines name suspicious activity reporting among the "Other Applicable Legal Requirements" a program should keep in view.
The overlap is useful, not duplicative, as long as the two teams share evidence and keep their decisions separate. The fraud team decides whether to restrict or close an account under the program; the BSA team decides whether a report is due, on its own clock, and nobody outside it may learn the answer. In the solution that division is built in: the action agent proposes the fraud response, the referral agent builds a packet for a queue only the BSA team can open, and the customer and partner notices are checked so that nothing in them reveals a referral.
Who enforces the red flags rule for banks?
The bank's own federal regulator. The FCRA assigns enforcement for banks to "section 8 of the Federal Deposit Insurance Act (12 U.S.C. 1818), by the appropriate Federal banking agency" and for federal credit unions to the NCUA (15 U.S.C. 1681s(b)). Each agency has its own copy of the rule.
Where each institution finds its red flags rule
| Institution | Rule | Enforced by |
|---|---|---|
| National banks and federal savings associations | 12 CFR 41.90 and Appendix J to part 41 | OCC |
| State member banks | 12 CFR part 222 | Federal Reserve |
| State non-member banks | 12 CFR parts 334 and 364 | FDIC |
| Federal credit unions | 12 CFR part 717 | NCUA |
| Non-bank creditors and other financial institutions under FTC jurisdiction | 16 CFR 681.1 and Appendix A to part 681 | FTC |
What happens to a bank without a working program?
The consequence is supervisory before it is financial. Because banks are examined against the rule, a missing or paper-only program becomes an examination finding, and repeated or serious failures can lead to the enforcement tools section 8 gives the agencies for any violation of law, including cease-and-desist orders and civil money penalties. The rule's own record keeping makes the point: the FAQs note the rules have no specific retention period but that banks "must be able to demonstrate that they have complied". A bank that cannot show its program detected and responded to red flags cannot demonstrate it complied.
The more expensive consequence is the fraud itself. A program that exists on paper does not stop a ring of new accounts from cashing out a check book; how a bust-out uses the first weeks of an account shows the cost. Writing the program document is the subject of the identity theft prevention program template; an auto lender's version of the program shows how the same rule reads for indirect lending. To see the detection and response work on your own accounts, start from New Account Fraud Detection.
The record an examiner asks for: who decided what, when, why and on which evidence
Questions people ask
Is the red flags rule the same as the customer identification program?
No. The customer identification program rule, under the Bank Secrecy Act, sets how a bank collects and verifies identity at account opening. The Red Flags Rule covers identity theft at opening and throughout the account's life, and the guidelines suggest using the CIP procedures as the opening-day detection step.
Does the red flags rule apply to business accounts?
Only if the bank's risk assessment finds a reasonably foreseeable risk of identity theft for them. Business accounts are not automatically covered, but the agencies' FAQs single out small businesses and sole proprietorships as particularly vulnerable.
How often must the identity theft program be updated?
The rule says "periodically", without a fixed interval. The guidelines expect staff to report to the board, a committee or a designated senior manager "at least annually" on compliance, and that report is where most banks review and update the program.
Does the red flags rule require a separate fraud system?
No. The guidelines allow a bank to incorporate "its existing policies, procedures, and other arrangements" that already control identity theft risk, and the FAQs say the rules require no specific technology. What matters is that the program, however built, detects and responds.
Does the rule cover first-party fraud?
Not directly. The rule is about identity theft, fraud using another person's identifying information. A real customer who opens an account in their own name and busts it out is committing fraud the bank should catch, but under its fraud and anti-money-laundering programs rather than the Red Flags Rule.