U.S. FACTA — Fair and Accurate Credit Transactions Act

Why does it matter?

FACTA turned identity theft from a consumer problem into a set of business duties with a regulator behind each one. A creditor that opens covered accounts without a board-approved Identity Theft Prevention Program breaches 16 CFR 681.1; a retailer that prints more than the last five digits or the expiration date on an electronic receipt breaches 15 U.S.C. 1681c(g); any business that discards consumer report information without reasonable measures breaches 16 CFR 682.3. Because the FCRA's private right of action and the FTC's and CFPB's enforcement authority sit behind these sections, the controls need owners, records and periodic review.

Key benefits include:

• Identity Theft Prevention Program

Section 114 and 16 CFR 681.1(d) require a written program to identify, detect and respond to Red Flags and to update itself periodically.

• Receipt truncation

Section 113 (15 U.S.C. 1681c(g)) bars printing more than the last five digits of the card number or the expiration date on electronically printed receipts.

• Proper disposal

Section 216 (15 U.S.C. 1681w) and 16 CFR 682.3 require reasonable measures against unauthorized access to consumer information when it is discarded.

• Consumer rights honored

Fraud and active duty alerts (section 112), free annual reports through the centralized source (section 211) and the affiliate marketing opt-out (section 214) create duties a business must build into its processes.

• Accuracy obligations

Section 312 requires furnishers to follow accuracy and integrity guidelines and regulations, and section 311 requires a risk-based pricing notice when credit terms are materially less favorable because of a consumer report.

How does it work?

Title I, Identity Theft Prevention and Credit History Restoration, added FCRA section 605A (section 112): on a consumer's request a nationwide consumer reporting agency must place an initial fraud alert, originally for not less than 90 days and since May 24, 2018 for not less than one year, refer it to the other nationwide agencies, and place seven-year extended alerts for identity theft victims and active duty alerts for service members. Section 113 added 605(g), the truncation rule for electronically printed receipts, phased in over one year for new machines and three years for machines in use before January 1, 2005.

Section 114 added 615(e), directing the agencies to establish Red Flag guidelines, to require each financial institution and creditor to adopt policies and procedures implementing them, and to require card issuers to validate an address change followed within at least 30 days by a request for an additional or replacement card. Sections 151 to 157 give identity theft victims a summary of rights, blocking of information resulting from identity theft, coordinated complaint investigations, protection against repollution of consumer reports and notices from debt collectors.

Title II added the free annual file disclosure once in any 12-month period through the centralized source (section 211), credit score disclosure (section 212), clearer prescreen opt-out notices (section 213), FCRA section 624 on affiliate sharing for marketing with its clear and conspicuous notice and simple opt-out (section 214), and FCRA section 628 on disposal of records (section 216). Title III added the risk-based pricing notice in 615(h) (section 311), the furnisher accuracy and integrity guidelines in 623(e) (section 312) and address reconciliation and reinvestigation duties (sections 314 to 317). Title IV limits medical information in consumer reports (sections 411 and 412), Title VI excludes certain employee misconduct investigations from the definition of consumer report, and Title VII sets preemption for the listed sections.

The implementing rules carry the operative detail. 16 CFR 681.1 applies to financial institutions and creditors under FTC enforcement: each must periodically determine whether it offers covered accounts (681.1(c)) and, if so, develop a written Identity Theft Prevention Program appropriate to its size and complexity that identifies relevant Red Flags, detects them, responds appropriately and is updated periodically (681.1(d)), with board or senior management approval, staff training and oversight of service providers (681.1(e)) and the Appendix A guidelines considered (681.1(f)). 16 CFR 681.2 is the card issuer address validation rule. 16 CFR 682.3 requires any person holding consumer information for a business purpose to dispose of it with reasonable measures, giving shredding, media destruction and disposal-contractor due diligence as examples.

Key Elements

• Fraud alerts and active duty alerts (section 112; 15 U.S.C. 1681c-1)

Initial alerts of not less than one year since the 2018 amendment, extended alerts of seven years for identity theft victims, active duty alerts, referral among the nationwide agencies and free report rights that follow an alert.

• Receipt truncation (section 113; 15 U.S.C. 1681c(g))

No person accepting cards may print more than the last five digits of the card number or the expiration date on electronically printed point-of-sale receipts; handwritten or imprinted records are excluded.

• Red Flags Rule (section 114; 16 CFR Part 681)

Covered accounts determined by periodic risk assessment; a written program that identifies, detects and responds to Red Flags and is updated; board approval, training and service provider oversight; card issuer address validation.

• Free annual reports and affiliate marketing (sections 211 and 214)

One free file disclosure in any 12-month period through the centralized source; affiliates may not use shared eligibility information for marketing solicitations without notice and a simple opt-out.

• Disposal Rule (section 216; 16 CFR Part 682)

Reasonable measures to protect against unauthorized access to or use of consumer information in connection with its disposal, for any person who maintains it for a business purpose; effective June 1, 2005.

• Risk-based pricing and furnisher accuracy (sections 311 and 312)

Notice to a consumer offered materially less favorable terms based on a consumer report; furnishers follow accuracy and integrity guidelines and regulations issued under 623(e).

• Medical information and preemption (sections 411 and 711)

Limits on furnishing and using medical information in employment, credit and insurance decisions; federal preemption of state law for the conduct the listed FCRA sections require.

What does it cover?

FACTA applies, through the Fair Credit Reporting Act it amends, to nationwide and other consumer reporting agencies, to users of consumer reports such as lenders, insurers, employers and landlords, to furnishers of information about consumers, to any person that accepts credit or debit cards and prints electronic receipts (section 113), to financial institutions and creditors that offer or maintain covered accounts (section 114 and 16 CFR 681.1) and to any person that possesses consumer information derived from consumer reports for a business purpose (section 216 and 16 CFR 682.2(b)). Rulemaking and enforcement are split among the FTC, the CFPB, the federal banking agencies, the NCUA and, for the Disposal Rule, the SEC, according to the entity.

What are its objectives?

Congress enacted FACTA to amend the Fair Credit Reporting Act, to prevent identity theft, improve resolution of consumer disputes, improve the accuracy of consumer records, make improvements in the use of, and consumer access to, credit information, and for other purposes, as its title states.

Prevent identity theft through fraud alerts, Red Flag programs, address validation, receipt truncation and proper disposal of consumer information.

Restore the credit history of identity theft victims through summaries of rights, blocking of fraudulent information and coordinated complaint handling (Title I, subtitle B).

Improve consumer access to credit information with the free annual report, credit score disclosure and clearer prescreen opt-outs (Title II).

Enhance the accuracy and integrity of consumer report information through furnisher duties, risk-based pricing notices and reinvestigation rules (Title III).

Limit the use and sharing of medical information in the financial system (Title IV) and set uniform national standards by preempting state law on the listed sections (Title VII).

Framework in Context

FACTA is an amendment to the Fair Credit Reporting Act, so its sections are read as FCRA sections and the CFPB's Regulation V (12 CFR Part 1022) carries most of the implementing rules, while the FTC keeps 16 CFR Parts 681 and 682 for entities under its jurisdiction. 16 CFR 682.3(b)(5) directs financial institutions subject to the GLBA Safeguards Rule (16 CFR Part 314) to fold proper disposal into their information security program, which is the practical link between FACTA and the GLBA. The Red Flags program also draws on the customer identification procedures of 31 U.S.C. 5318(l), with which section 114(e)(3) requires the guidelines to be consistent.

Common Framework Mappings

FACTA controls are frequently mapped to other data privacy, security, and financial industry frameworks to simplify compliance, unify risk management, and meet overlapping regulatory requirements around consumer information protection.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

GLBA Safeguards Rule (16 CFR Part 314)

HIPAA

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2