On February 28, 2012, the SEC and the CFTC jointly proposed rules that would require funds and advisers to affirmatively combat identity theft. The proposed rules would require registered investment companies, investment advisers, commodity pool operators (“CPOs”), commodity trading advisors (“CTAs”), and other SEC- or CFTC-regulated entities to create programs to detect and respond to red flags. The proposed rules would also establish special requirements for certain credit and debit card issuers to assess the validity of notifications of changes of address in certain circumstances.

COVERED FINANCIAL INSTITUTIONS AND ACCOUNTS. The SEC’s proposed rules and guidelines would apply to a financial institution or creditor, as defined by the Fair Credit Reporting Act of 1970 (the “FCRA”), including SEC-registered investment companies, investment advisers, brokers, dealers, and other entities registered under the Securities Exchange Act of 1934. The CFTC’s proposed rule would apply to CPOs, CTAs, futures commission merchants, introducing brokers, swap dealers, major swap participants, and retail foreign exchange dealers.

A “covered account” would include any account “that the financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft.” The SEC’s proposed definition includes, for example, a brokerage account with a broker-dealer and an account maintained by a mutual fund that permits wire transfers or other payments to third parties. The CFTC’s proposed definition of a “covered account” includes a margin account as an example.