News and Information
July 29, 2009

Federal Red Flags Rule Enforcement Delayed until November 1

July 29, 2009—The Federal Trade Commission today postponed enforcement of the new federal Red Flags Rule that requires businesses — including some law practices — to have protocols for prevention of identity theft.

The American Bar Association will continue its efforts to make lawyers exempt from the rule.

“Long term, we will continue to work with Congress and the FTC on a legislative fix, with a lawsuit still a possibility should it become necessary,” Ann Carmichael, legislative counsel in the ABA’s Governmental Affairs Office, wrote in a July 29 e-mail to state bar executives.

During the next three months, the FTC will educate businesses about whether they are covered by the rule and what they need to do to comply. (See

The FTC also has posted frequently asked questions that address law firms’ responsibilities in regard to the rule. (See

These include:

Our clients pay a retainer before we provide services. Although we may send an invoice for our charges, we satisfy it by drawing on the retainer. Does this make us a creditor under the Red Flags Rule?

No, an arrangement like that wouldn’t make your business a creditor. Many businesses require a payment before work begins. For example, a law firm may require clients to pay a retainer. Some medical practices charge patients monthly fixed fees for unlimited services. They may send their clients or patients invoices each month, but draw payment from the money they’ve already received. The Red Flags Rule applies to businesses that regularly defer payment until after services have been performed. Because the law firm or medical practice in this example is paid before they provide services, these arrangements aren’t “credit,” as the law defines that word.

My law firm brings cases on a contingency basis. Does this type of fee arrangement make me a creditor under the Red Flags Rule?

No. Generally, under a contingency fee arrangement, a law firm will not earn its fee unless and until it wins a recovery for its client. Therefore, this arrangement is not a credit relationship, and the law firm would not be a creditor under the Red Flags Rule. If, however, the client is responsible for certain litigation expenses regardless of the outcome of the case, the firm would have to consider whether there is a deferral of payment that would meet the definition of “credit.”

Lawyers can learn about the rule and how to comply with it by reading Fighting Fraud with the Red Flags Rule: A How-To Guide for Business, at A template for businesses that are at low risk for identity theft is available at

The American Bar Association was notified in April 2009 that the FTC was including lawyers and law firms among the professionals required to comply with the Red Flags Rule, because they are considered “creditors” who regularly bill their clients for services after the services are rendered.

The ABA argues that lawyers do not bill by extending credit. Application of the Red Flags Rule to lawyers would impose federal oversight and an onerous burden on law firms’ time and would probably not prevent any identity theft, the ABA contends.

For more resources about the Red Flags Rule and the ABA response, see

Updated: Jul 29, 2009