Q: How do the Red Flags Rules apply to indirect lending? Is a consumer loan that is purchased by the financial institution or creditor (e.g., a mortgage loan or car loan) a “covered account?”
A: A consumer loan, such as a mortgage or auto loan, is covered under the first part of the “covered account” definition (set out above under II.B.1) to the extent that it is “an account that a financial institution or creditor offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions.”
In the case of such loans, the financial institution or creditor that initially extends credit to the consumer is responsible for applying its Identity Theft Prevention Program to the opening of that covered account. If that loan is purchased by another financial institution or creditor, then that entity becomes responsible for applying its Identity Theft Prevention Program to the loan as an existing covered account.