Today the Federal Trade Commission announced that it will delay enforcement of the Red Flags Rule for six months to provide entities of all types additional time to come into compliance. The FTC's decision to delay enforcement only applies to those entities regulated by the Federal Trade Commission. Those entities regulated by banking and credit union federal agencies must still comply by November 1, 2008 unless specified differently by the other regulatory agencies.

The FTC said the their decision to extend the compliance date until May 1, 2009 was based on staff findings during outreach efforts.   FTC "staff learned that some industries and entities within the FTC’s jurisdiction were uncertain about their coverage under the Rule. These entities indicated that they were not aware that they were engaged in activities that would cause them to fall under the FACT Act’s definition of creditor or financial institution. Many entities also noted that, because they generally are not required to comply with FTC rules in other contexts, they had not followed or even been aware of the rulemaking, and therefore learned of the Rule’s requirements too late to be able to come into compliance by November 1, 2008. The Commission’s delay of enforcement will enable these entities sufficient time to establish and implement appropriate identity theft prevention programs, in compliance with the Rule."