The proposed regulations include guidelines listing patterns, practices, and specific forms of activity that raise a “red flag” signaling a possible risk of identity theft. An institution or creditor would be required to incorporate into its program those red flags from the guidelines that are relevant to detecting the risks of identity theft to its customers or its own safety and soundness. Given the changing nature of identity theft, an institution or creditor also would be required to incorporate additional red flags on an ongoing basis from its own experiences, supervisory guidance, and other methods of identity theft the institution or creditor has identified.

....