SEC Regulation S-ID (Identity Theft Red Flags)
Written identity theft prevention programme for broker-dealers holding covered accounts.
- Issued by
- US Securities and Exchange Commission
- Applies in
- United States
- Edition
- 2013 joint CFTC/SEC rules; compliance from 20 November 2013
- Area
- Data protection & privacy
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- 248.201(c)Periodically determine whether the firm offers covered accountsScope
- 248.201(d)(1)Written Identity Theft Prevention ProgrammeProgramme
- 248.201(d)(2)(i)-(ii)Identify and detect relevant red flagsDetection
- 248.201(d)(2)(iii)Respond appropriately to detected red flagsResponse
- 248.201(d)(2)(iv)Update the programme periodically for changing risksGovernance
- 248.201(e)Board approval, senior-management oversight, training and service-provider oversightGovernance
- 248.202Validate card-issuer change-of-address requestsDetection
How Amoreg keeps you on it.
Enable the SEC Regulation S-ID (Identity Theft Red Flags) and add US Securities and Exchange Commission’s pages as a monitor of your own. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 7 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read US Securities and Exchange Commission’s pages
- Check the library against 7 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: periodically determine whether the firm offers covered accounts
- Rule
- SEC Regulation S-ID (Identity Theft Red Flags), 248.201(c)
- Area
- Scope
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- EU General Data Protection RegulationThe data protection regime for controllers and processors established in, or targeting, the EU.European Union · 9 controls
- UK GDPR & Data Protection Act 2018The UK data protection regime after Brexit, with the ICO as supervisory authority.United Kingdom · 9 controls
- Data Protection (Bailiwick of Guernsey) Law, 2017The Bailiwick's GDPR-equivalent law, with EU adequacy.Guernsey · 9 controls
- Data Protection (Jersey) Law 2018Jersey's GDPR-equivalent law and the Data Protection Authority (Jersey) Law 2018 registration regime.Jersey · 9 controls
- Isle of Man GDPR & LED Implementing Regulations 2018The applied GDPR under the Data Protection Act 2018 (Isle of Man).Isle of Man · 9 controls
- Cayman Islands Data Protection ActEight data protection principles modelled on the UK Data Protection Act 1998, in force since 2019.Cayman Islands · 6 controls
Also in United States
- US Bank Secrecy Act / FinCEN AML ProgramBSA AML programme requirements: the pillars, CDD rule, SAR/CTR reporting and beneficial ownership.United States · 6 controls
- OFAC Sanctions Compliance ProgramThe five essential components of an effective sanctions compliance programme.United States · 5 controls
- US Foreign Corrupt Practices ActAnti-bribery and books-and-records provisions, assessed against the DOJ's Evaluation of Corporate Compliance Programs.United States · 4 controls
- GLBA Safeguards RuleThe information security programme financial institutions must maintain for customer information.United States · 5 controls
- NIST Cybersecurity Framework 2.0Six functions for managing cybersecurity risk, now including Govern.United States / Global · 6 controls
- NYDFS Cybersecurity Regulation (23 NYCRR 500)Cybersecurity requirements for DFS-licensed entities, with CISO, MFA, annual certification and 72-hour notice.United States — New York · 6 controls
Questions
Does Amoreg watch for changes to the SEC Regulation S-ID (Identity Theft Red Flags)?
Enable it and add the issuer’s pages as a monitor of your own. Every publication the Monitor records keeps its source, stage and date.
Can Amoreg check our policies against the SEC Regulation S-ID (Identity Theft Red Flags)?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records 2013 joint CFTC/SEC rules; compliance from 20 November 2013. Editions were last verified in August 2026, and the Monitor records new publications as they appear.