Run the FTC Red Flags Rule two-part creditor test if you check credit before financing customer equipment

The FTC’s Red Flags Rule requires financial institutions and some creditors with covered accounts to keep a written identity theft prevention program. Billing customers later is not enough to qualify, but regularly using consumer reports in credit decisions is, even when a third party pulls the reports.

Source facts

The FTC’s Red Flags Rule guide says the Rule requires many businesses to implement a written identity theft prevention program. The program must identify the red flags that may occur in daily operations, detect them, spell out the actions taken when they are detected, and detail how it will be kept current.

The Rule applies to financial institutions and some creditors, and a written program is required only if the business has covered accounts. A business is a creditor only if it regularly defers payment, bills customers or arranges credit and also regularly gets or uses consumer reports in a credit transaction, furnishes information to credit reporting companies, or advances funds. Deferring payment alone is not advancing funds, accepting credit cards alone does not make a business a creditor, and checking credit reports to screen job applicants does not trigger the Rule.

The Rule applies whether a business uses credit reports directly or a third party evaluates them for it. Covered accounts include consumer accounts that allow multiple payments, and other accounts with a reasonably foreseeable risk of identity theft. Even a low-risk business needs a written program approved by its board or an appropriate senior employee.

Applicability

Use this for businesses under FTC jurisdiction; banks and some other financial institutions follow their own regulators’ versions of the Rule. Whether a specific business is covered depends on its facts, so keep counsel involved in the conclusion.

DSE recommendation

DSE recommends documenting a Red Flags Rule applicability analysis for any business that regularly uses consumer reports in connection with customer credit. If covered, write a proportionate program that names the red flags seen in your sales and billing process, such as mismatched identification or a new account used in unusual ways, and assign a senior employee to approve it. Repeat the risk assessment when financing or billing practices change.

Verification

Keep the written applicability analysis, program approval and annual review with compliance records, and sample new financed accounts each quarter to confirm the identity checks in the program were performed.

Official reference

Federal Trade Commission — Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business. Reviewed October 18, 2026.