It is axiomatic that politics affects business decisions; Congress and state legislatures have always regulated business practices. Sometimes, however, the changing currents of political thought confuse the business process. Such is the case with the U.S. Federal Trade Commission’s (FTC) Red Flags Rules.
On December 31st, the U.S. Federal Trade Commission (FTC) “Red Flag” rules, which require covered businesses to develop plans to thwart identity theft, may become effective. Three times delayed by the FTC, it is simply not clear if there will be any more generally applicable delays. But there is a bill before the U.S. House of Representatives, H.R. 2345, to exempt health care facilities with 20 or fewer employees; and legal and accounting firms are lobbying hard for exemption, too. Unfortunately, even if passed by the lame duck Congress, none of the exemptions applies to the majority of companies in the relocation industry. A change in control of Congress might portend a further delay and a rewrite, but companies cannot be certain that this will occur. Good risk management practiced require covered companies to have a policy ready to be put in place on or before December 31st. Unless, of course, further delay is granted by the FTC.
The reach of the Red Flags Rule as currently written is very wide, and would include almost every company that bills consumers after selling a good or service to them, and the current text may even go further. The issue is not how to implement the rules – which require setting up a separate anti identity theft program – but whether the company has “covered accounts”, i.e., whether the company needs to implement them. This is the dilemma facing our industry suppliers today.
By the way, prior to the last postponement, we published an analysis of the requirements of the rules here: http://www.worldwideerc.org/gov-relations/us-tax-legal-resources/tax-legal-updates/Documents/gr-update-0510.html#2. Absent any change, these will become effective December 31st.
What’s a company to do? Well, the Worldwide ERC® Government Relations Council is watching over the issue, and shortly after the November elections will publish the most current data and recommendations, including our analysis of the coverage. This will allow companies time to begin planning to set up a compliance program. Of course, no one can guarantee that the effective date of the rules will not change. Last time, they were postponed two days before they were supposed to become effective.