First, your credit union must select an individual

or committee to oversee, administer and update the program.

Second, your credit union must conduct a risk assessment to identify all covered accounts for the rule. Covered account is defined broadly as an account that a credit union offers or maintains, primarily for personal, family or household purposes, that involves or is designed to permit multiple payments or transactions, such as a credit card account, mortgage loan, automobile loan, checking account, or share account. A covered account is also any other account that the credit union offers or maintains for which there is a reasonably foreseeable risk to members or to the safety and soundness of the credit union from identity theft, including financial, operational, compliance, reputation or litigation risks. Because of how broad the definition is, most credit unions tell us that they will treat every account as a covered account.

In conducting a comprehensive risk assessment, your credit union should take into consideration risk factors such as the types of accounts offered, methods provided to open accounts, methods provided to access accounts and previous experiences with identity theft. Determine where you are vulnerable and the safeguards necessary to address these vulnerabilities.

A List of 21 Red Flags

Third, identify relevant red flags. The regulators provided us with five general categories of red flags:

-Alerts, notifications or other warnings received from consumer reporting agencies or service providers;

-Presentation of suspicious documents;

-Presentation of suspicious personal identifying information;

-Suspicious activity; and

-Notice from members, victims of identity theft, law enforcement authorities or other persons regarding possible identity theft.

In addition, supplement A to appendix J of the rule includes a list of 21 identity theft red flags. Definitely include any additional red flags based on your own experiences.

Fourth, develop procedures and controls to detect the relevant identified red flags. The detection requirement is simply a due diligence requirement to utilize sound controls that will help in detecting the red flags. A detection control example is obtaining identifying information about, and verifying the identity of, a person opening an account by using the policies and procedures regarding identification and verification set forth in your customer identification program.

Another example is authenticating members, monitoring transactions and verifying the validity of change of address requests. It is important to note that your procedures may reference existing customer identification program and security procedures as controls to detect appropriate red flags.

Fifth, develop and document controls to prevent and mitigate red flags. Logically, your credit union must appropriately respond to detected red flags. The appropriate credit union response will vary depending on the risk posed by the detected red flag. The regulators have provided several examples of credit union responses, including monitoring a covered account for evidence of identity theft, contacting the member, and changing any passwords, security codes or other security devices that permit access to an account.

Your credit union must also have controls in place to prevent and mitigate red flags related to third-party providers. Examples include requiring the service provider by contract to have policies and procedures to detect relevant red flags that may arise in the performance of the service provider's activities.

Sixth, your credit union must obtain written approval of the program from the board of directors or an appropriate committee of the board of directors. In addition, staff must be trained to implement the program, including being aware of identified red flags, controls to detect these red flags, and appropriate responses to detection.

The final step requires your credit union to keep the program updated based on factors such as experiences with identity theft, types of accounts offered and changes in service providers. Your program administrator must report to the board of directors, an appropriate committee of the board or a designated employee at the level of senior management, at least annually, on compliance by the credit union.