Identity Theft Red Flags Rule
Regulation S-ID, Rule 201 · 17 CFR 248.201
Duties regarding the detection, prevention, and mitigation of identity theft
Read the current text at the source ↗Guide: Regulation S-P Compliance Checklist for Investment Advisers
Guide: Cybersecurity for RIAs: What the SEC Expects of Investment Advisers
- Applies to
- SEC-registered investment adviser
- Effective
- May 20, 2013
- Compliance date
- November 20, 2013
When this applies
Applies to an adviser that is a financial institution or creditor under the Fair Credit Reporting Act and offers or maintains covered accounts, which it must periodically determine, with a risk assessment. That is broader than firms assume: it reaches an account primarily for personal, family or household purposes that is designed to permit multiple payments or transactions, and any other account for which there is a reasonably foreseeable risk of identity theft. An adviser with discretion over client assets, or the ability to move money, should work through the determination rather than assuming the rule is for broker-dealers.
What the rule says
A description of the source text.
Requires a firm that offers or maintains covered accounts to have a written Identity Theft Prevention Program, appropriate to its size and complexity, designed to identify relevant red flags, detect them, respond appropriately when one is detected, and be updated periodically as risks change. The board of directors or an appropriate committee of it must approve the initial programme (a firm with no board designates a senior management employee to act as one). The board, a committee or a designated senior manager oversees its development, implementation and administration, staff are trained, and service provider arrangements are overseen. 78 FR 23663 (19 April 2013).
What it requires
Luna's plain-English reading, not the Commission's words.
- 01Start with the covered account determination and write it down. Concluding that the rule does not apply is a conclusion an examiner can ask to see.
- 02It is a separate obligation from Regulation S-P. A safeguards policy is not an identity theft prevention programme, and firms routinely have one and not the other.
- 03The initial programme is approved by the board or a board committee (a designated senior manager only where there is no board), not by the CCO alone.
- 04Service providers who perform activities in connection with covered accounts are inside the programme.
What examiners find
Luna's observations, not a Commission publication.
- No programme at all, on an unwritten assumption that the rule is for broker-dealers.
- A programme adopted once and never updated as the firm added ways for money to move.
- No record of board or board committee approval.
Topics
Source last checked against the regulator's copy on October 14, 2026. That date is written by an automated check, not by hand.
Luna Compliance is software, not a law firm. This page is not legal advice and reading it creates no attorney-client relationship. Where this page and the regulator's copy differ, the regulator's governs.