Red Flags Rule Compliance for Auto Dealerships

Red Flags Rule for Dealerships: Identity Theft Prevention Program

This article is for informational purposes and does not constitute legal advice. Consult qualified legal counsel for compliance guidance specific to your dealership.

—

Bottom Line Up Front

If your F&I office is processing credit applications, your store is a covered creditor under the Red Flags Rule — full stop. That means you have a federal obligation to maintain a written Identity Theft Prevention Program (ITPP), train your staff on it, and update it regularly. This isn’t a box-check exercise. Identity fraud in auto retail is a real and growing exposure, and the FTC has demonstrated it will pursue enforcement against dealers who treat compliance as optional.

The Red Flags Rule car dealership obligation is not complicated to implement, but it requires intentional structure. Stores that ignore it don’t just risk FTC civil penalties — they expose themselves to state AG actions, private litigation, and reputational damage that no dealer group wants walking into an OEM review or a floorplan audit.

Build the program. Document it. Train your people. The rest of this guide tells you exactly how.

—

Regulatory Overview

The Law Behind the Obligation

The Red Flags Rule was promulgated under the Fair and Accurate Credit Transactions Act (FACTA) and is implemented through 16 CFR Part 681. The FTC enforces compliance for most automotive dealers. If your store has any federally insured deposits or falls under CFPB jurisdiction due to certain transaction thresholds or structures, CFPB oversight may also apply — your counsel can clarify your specific position.

The rule itself is straightforward: covered businesses must develop and implement a written program to detect, prevent, and mitigate identity theft in connection with the opening or maintenance of “covered accounts.”

Who Enforces It

Primary enforcer: the Federal Trade Commission. The FTC has authority to investigate, issue civil investigative demands, and seek civil penalties through the courts. State Attorneys General can also bring actions under state consumer protection laws that parallel or exceed federal standards. Don’t assume your state is less aggressive than the FTC — several AGs have made auto retail a priority enforcement area.

Who’s Covered

Dealer Type	Covered Under Red Flags Rule?	Notes
Franchise new-car dealer	Yes	Extends credit via retail installment contracts
Independent used-car dealer	Yes	Same — RISC or buy-here-pay-here arrangements qualify
BHPH dealer	Yes	Directly extends credit; heightened exposure
Dealer that only brokers deals	Likely yes	Facilitating credit extension is typically sufficient
Pure cash-only retailer	Evaluate carefully	If no credit accounts are opened or maintained, may not apply — confirm with counsel

The practical reality: if your F&I office runs a credit app, you are covered. If you take trade-ins and run DMS accounts for service customers, those are likely covered accounts too.

Key Definitions in Dealer Language

Covered Account: any account that involves credit — your retail installment contracts, lease agreements, and ongoing service accounts where customers are billed over time.
Red Flag: a pattern, practice, or specific activity that signals possible identity theft. Think: a driver’s license that doesn’t match the SSN on the credit app, an address that rings a fraud alert flag from the bureau, or a customer who can’t verify information you’d expect them to know cold.
ITPP (Identity Theft Prevention Program): your written, board- or principal-approved program that lays out how you identify, detect, respond to, and update your red flags protocols.

—

Requirements Breakdown

The Four-Part Program Structure

The FTC requires your ITPP to do four things. Think of it as a continuous loop, not a one-time project.

1. Identify Relevant Red Flags. Your program must list the specific red flags applicable to your dealership’s operations. The FTC provides a non-exhaustive list in the rule’s supplemental guidance, including alerts from consumer reporting agencies, suspicious documents, unusual account activity, and notices from customers or law enforcement. Your red flags list should be tailored to where your store actually sees fraud — F&I is your highest-risk touchpoint.

2. Detect Red Flags. You must have procedures in place to actually catch the flags you’ve identified. In practice, this means your F&I managers and desk staff need documented protocols for verifying IDs, cross-referencing information from the credit bureau alert with what the customer presents, and escalating when something doesn’t add up.

3. Respond Appropriately. Detection without a response protocol is worthless. Your ITPP must define what happens when a red flag is triggered: Who gets notified? Can the deal proceed? What documentation is required? Do you contact law enforcement? Every red flag scenario should have a mapped response — even if that response is simply “verify additional information before proceeding.”

4. Administer and Update the Program. Your program must be approved by your board of directors, a designated senior employee, or an appropriate governing body — in most dealer group structures, that’s the dealer principal or a named compliance officer. It must be reviewed and updated regularly to reflect new fraud patterns, operational changes, or regulatory guidance.

Documentation and Record-Keeping

Your written ITPP is the cornerstone document. Beyond that, you need to maintain:

Training logs showing who was trained, when, and on what material
Incident logs documenting any detected red flags, the response taken, and the outcome
Annual review records demonstrating the program was evaluated and updated
Vendor agreements confirming that any third-party service providers handling covered accounts are contractually required to comply with your ITPP

If the FTC walks in — or if you get hit with a civil investigative demand — these records are what demonstrate good-faith compliance. “We do it but didn’t write it down” is not a defense.

Employee Training Requirements

The rule doesn’t mandate a specific training frequency, but your program must include training, and your documentation needs to show it’s actually happening. Best practice:

Onboarding training for any new hire touching F&I, sales, or service billing
Annual refresher for all covered employees — at minimum, your F&I managers, sales managers, and BDC staff handling credit-related customer data
Incident-triggered retraining whenever a red flag is actually detected or a fraud attempt occurs

Your training content should cover: what your specific red flags are, the detection procedures they’re expected to execute, the escalation chain, and the consequences of non-compliance.

Signage, Disclosures, and Forms

The Red Flags Rule itself doesn’t prescribe specific signage or customer disclosures in the same way the Privacy Notice rule does. However, your internal forms should include:

An ITPP acknowledgment form for employees completing training
A checklist embedded in your deal jacket process confirming ID verification was performed and documented
Language in your vendor agreements requiring third-party compliance

Many dealers integrate the ID verification checklist directly into the F&I deal checklist in their DMS — that’s the right instinct.

—

Compliance Checklist

Use this as your internal audit framework. Assign ownership before your next managers meeting.

Action Item	Owner	Cadence
Written ITPP drafted and on file	Compliance Officer / F&I Director	One-time, then annual review
ITPP approved by dealer principal or board	Dealer Principal	Annual re-approval
Red flags list documented and current	Compliance Officer	Annual + after any fraud incident
Detection procedures written into deal process	F&I Director / GSM	Annual review
Response protocols documented for each flag	Compliance Officer	Annual review
Employee training conducted and logged	HR / F&I Director	Onboarding + annual
Vendor agreements reviewed for compliance language	GM / Counsel	Annual
Incident log maintained	Compliance Officer	Ongoing
Annual program review completed and documented	Dealer Principal + Compliance Officer	Annual
Self-audit against FTC supplemental guidance	Compliance Officer or Counsel	Annual

Self-audit tip: when you pull your DMS records for the annual review, verify that every deal jacket from the prior year has a completed ID verification step documented. Gaps in that trail are exactly what regulators look for.

—

Common Violations and Penalties

The Mistakes Stores Actually Get Cited For

No written program at all. This is the most common finding — dealers who are doing the right things operationally but have nothing on paper.
Program exists but hasn’t been updated. A Red Flags program written years ago that hasn’t been reviewed is not compliant. The rule requires ongoing administration.
No training documentation. Verbal training that no one can prove happened is the same as no training in a regulatory review.
Failure to supervise vendors. If your DMS provider, a third-party finance platform, or a service customer billing system handles covered account data, your program must extend to them contractually.
No incident response. Stores that detect potential fraud but have no documented protocol — or who proceed with the deal anyway without additional verification — are in the highest-risk position.

Penalties and Litigation Exposure

The FTC can seek civil penalties per violation — and in the context of identity theft in a dealership, “per violation” can add up fast if you’re processing significant deal volume. Beyond federal penalties, state AGs can pursue parallel actions under state unfair and deceptive acts and practices (UDAP) statutes, and affected consumers may have private rights of action under applicable state law.

The reputational and remediation costs — consumer notification, credit monitoring obligations, legal fees — often dwarf the regulatory fines themselves. Franchise dealers also face OEM scrutiny; a consent decree or FTC action can surface in your franchise renewal process.

—

Building a Compliance Culture

Compliance as Operations, Not Overhead

The stores that run the cleanest compliance programs don’t treat it as a separate function — they’ve baked it into the deal process at every touchpoint. Your F&I checklist includes ID verification. Your desk manager knows the escalation protocol. Your BDC has a script for handling suspicious inquiry patterns. None of that is burdensome if it’s simply part of how you work.

Training Cadence and Accountability

Make Red Flags Rule training a standing agenda item at your annual F&I review — alongside VSC penetration rates, back-end PVR, and menu compliance. When compliance lives in the same conversation as performance, your team internalizes it as part of the job, not a legal exercise they endure once a year.

Designating a Compliance Point Person

Every store should have a named compliance officer or compliance coordinator — even if it’s a dual-hat role held by your F&I director or controller. This person owns the ITPP, maintains the documentation, runs the training calendar, and is the first call when a red flag triggers. Without a named owner, accountability dissolves.

When to Involve Outside Counsel

Bring in qualified automotive retail counsel when:

You’re drafting or substantially revising your ITPP for the first time
You’ve had a confirmed fraud incident and need to assess notification obligations
You’re adding a new product line, rooftop, or financing structure that may change your covered account profile
You receive any inquiry, investigative demand, or complaint from a regulatory body

Don’t wait for a problem to build the relationship with your compliance counsel. The dealers who weather regulatory scrutiny cleanest are the ones who had outside counsel in the loop before anything went wrong.

—

Frequently Asked Questions

Does the Red Flags Rule apply to my independent used-car lot, or just franchise dealers?

It applies to both. Any dealer that extends credit or facilitates credit extension through retail installment contracts is a covered creditor under the rule, regardless of whether you hold a franchise agreement. Buy-here-pay-here operations have arguably the highest exposure because they directly extend and maintain credit accounts.

How often do I need to update my Identity Theft Prevention Program?

Your program must be reviewed and updated at least annually, and additionally any time your operations change in a way that introduces new fraud risks — new F&I products, a new DMS platform, an acquisition, or a confirmed fraud incident. Document every review with a signed approval from your dealer principal or compliance officer.

What counts as a “red flag” that my F&I team needs to act on?

Red flags include alerts or notifications from consumer reporting agencies (fraud alerts, active duty alerts), suspicious documents (IDs that appear altered, photos that don’t match the customer), inconsistent information (the address on the app doesn’t match the bureau, the customer can’t verify basic personal information), and unusual account activity. Your written ITPP should enumerate the specific flags most relevant to your store’s fraud patterns.

If my DMS vendor handles identity verification, am I still responsible?

Yes. Delegating a function to a vendor doesn’t transfer your regulatory obligation. Your ITPP must include requirements for any service provider that handles covered account data, and your vendor agreement should include contractual language requiring their compliance with your program. Audit your vendors’ compliance — don’t just assume it.

What’s the difference between the Red Flags Rule and the Safeguards Rule?

These are two separate and distinct obligations. The Red Flags Rule requires you to detect and prevent identity theft in connection with covered accounts. The FTC Safeguards Rule (under the Gramm-Leach-Bliley Act) requires you to maintain a comprehensive information security program to protect customer financial data. They overlap in spirit but impose different specific requirements. Your dealership needs both programs — talk to counsel if you’re not certain you have compliant documentation for each.

—

Conclusion

The Red Flags Rule isn’t the most complex compliance obligation on your plate, but it’s one of the ones where documented non-compliance is easy to demonstrate — and easy to avoid if you build the program correctly from the start. A written ITPP, a trained team, a named compliance owner, and an annual review cycle are the bones of it. The operational piece — baking ID verification and escalation protocols into your deal process — is how you make it real.

Pull your current ITPP out of the drawer today. If you can’t find it, that’s your answer on where to start. If it hasn’t been reviewed and re-approved since the first time it was written, schedule that review before your next OEM audit or floorplan review creates an awkward moment.

The stores that consistently outperform on both compliance and profitability are running tight operations across the board — clean deal jackets, disciplined desk processes, and management teams that treat regulatory requirements as part of how a well-run store operates, not a tax on their time.

CarDealership.com’s dealer growth platform is built for exactly that kind of operation. With an integrated CRM, automated lead follow-up, reputation management, and marketing tools purpose-built for auto retail, it gives your team the infrastructure to run a cleaner, higher-volume store without adding administrative overhead. If you’re ready to see what that looks like for your rooftops, book a demo and find out how hundreds of dealerships are using CarDealership.com to capture more leads, close more deals, and grow fixed ops revenue — all from one platform.

—