OFAC/NPI

• These acts and rules protect consumer and customer Nonpublic Personal Information (NPI) and prevent identity theft.

Laws and Regulations

• Gramm-Leach-Bliley Act (GLB Act) contains the:
  • Financial Privacy Rule
  • Safeguards Rule
• Fair Credit Reporting Act (FCRA) contains the:
  • Disposal Rule
  • Red Flags Rule (prevents identity theft)

Corporate Compliance Officer (CCO)

• Dealers are required to appoint a Corporate Compliance Officer (CCO) to comply with NPI handling and identity theft prevention laws.
• The CCO must create, implement, monitor, enforce, and update written policies and procedures (P&P).
• The role includes conducting and documenting training for personnel impacted by the P&P programs.

Protecting Nonpublic Personal Information (NPI)

• Customer information includes "nonpublic personal information" (NPI), which is "personally identifiable financial information."
• NPI is any information not legally accessible on the internet or in a phonebook.
• NPI examples:
  • Social Security numbers
  • Driver’s license numbers
  • Credit card numbers
  • Unlisted phone numbers
• Under updated Safeguards Rule, even the fact someone is a customer is considered NPI.

Financial Privacy Rule

• Requires dealerships to provide a Privacy Notice explaining information-sharing practices when a prospective buyer provides NPI on a credit application.
• Consumers can limit some information sharing.
• All customers must receive a written Privacy Notice, not orally.
• Dealers must use the "safe harbor" notices on the FTC website without deviation.

Safeguards Rule

• Protects NPI in paper and electronic format.

Updated Safeguards Rule

• A qualified individual such as a Chief Information Officer (CIO) governs the updated Safeguards Rule.
• Requires:
  • Encryption for all customer information in transit and at rest or effective alternative controls.
  • Multifactor authentication for accessing information systems or a reasonable equivalent.
  • Procedures to dispose of customer information no later than two years after its last use, with exceptions for regulatory mandates.
  • Continuous monitoring or periodic penetration testing and cybersecurity vulnerability assessments.
  • A written incident response plan to address security events affecting customer information confidentiality, integrity, or availability.

Information Security Program (ISP)

• Elements of A Typical Programs include:
  • Limiting access to NPI storage locations.
  • Installing time-out/password features on computers with NPI.
  • Securing NPI under lock and key, never leaving it unattended.
  • Documenting training for all employees and new hires on the ISP.
  • Allowing only authorized personnel access to NPI.
  • Reporting ISP breaches to the compliance officer.

Penalties for Noncompliance

• Failure to comply with Privacy or Safeguards Rules may result in:
  • FTC enforcement action with fines up to $53,088 per violation; potentially per vehicle sold if the ISP is flawed.
  • Unfair or Deceptive Acts or Practices (UDAP) claims at state and federal levels.
  • Individuals can report violations to applicable agencies.

Disposal Rule

• Requires dealerships to use reasonable disposal practices to prevent unauthorized access to consumer report information and NPI.
• Information from consumer reports or collected from consumers can't be thrown in the trash, and needs to be:
  • Paper burned, pulverized, or shredded.
  • Electronic data destroyed or erased.
• The dealership must:
  • Destroy any collected NPI.
  • Conduct due diligence when hiring a document destruction service.
  • Document the destruction of materials containing NPI.

Red Flags Rule

• Requires measures to prevent identity thieves from using someone else’s NPI to buy a car.
• Requires appointing a Corporate Compliance Officer (CCO) to implement an Identity Theft Prevention Program (ITPP).

Identity Theft Prevention Program (ITPP)

• Also known as a Red Flags Rule Program
• Must be approved by the Board of Directors and updated periodically.
• The purpose is to:
  • Identify relevant red flags.
  • Detect and evaluate red flags.
  • Respond to detected red flags.

Identity Verification Methods

• Methods of Verifying Identity:
  • Confirm information matches across sources like credit applications, credit reports, driver’s licenses, and insurance cards.
  • Check SSN against the Death Master List and confirm it matches Social Security Administration patterns.
  • Have the consumer take a "selfie" with their driver's license.
  • Ask challenge questions.

Practices to Prevent Identity Theft

• Secure a fully completed credit application to triangulate information.
• Control the transaction's pace and be alert for disruptions.
• Involve a manager for implausible situations.
• Avoid delivering the car if uncomfortable.

IRS Form 8300

• Required to report cash transactions over $10,000 from one buyer on an IRS Form 8300.
• What constitutes Cash?
  • U.S. and foreign currency
  • Money instrument with a face value of $10,000 or less such as:
    • Cashier’s check
    • Money order
    • Traveler’s check
    • Bank draft
• What is Not Cash?
  • Personal checks
  • Wire transfers
  • Proceeds of a loan (a lien will be recorded)
  • Individual cashier’s checks, money orders, traveler’s checks, or bank drafts with a face amount over $10,000

Transactions that Require Filing IRS Form 8300

• Receiving multiple cash instruments under $10,000 that total over $10,000.
• Related cash transactions within 24 hours, each under $10,000, totaling over $10,000.
• Receiving over $10,000 in cash over 12 months from a single transaction.
• Receiving a cash down payment over $10,000, even if the sale doesn’t happen.

IRS Filing Rules

• File the form with the IRS within 15 days of the transaction.
• No obligation to inform the customer at the time of the transaction a form has been filed
• Notify the customer in writing by January 31st of the following year.
• Include the name of individual(s) who presented the cash.

Taxpayer Identification Number (TIN) Section

• Individual customers/sole proprietorships: SSN
• Nonresident aliens: Individual Taxpayer Identification Number (ITIN)
• Corporations, partnerships, estates: Employer Identification Number (EIN)

Exceptions to Line 6

• If a customer refuses to provide their SSN:
  • Leave line 6 blank.
  • Write "Customer refused to provide their SSN" in the comments.
  • Record the customer’s driver’s license number.
• If a customer is a Non-Resident Alien
  • Record the customer’s driver's license or passport number
  • Include a photocopy of the ID in the filing,
  • You aren’t required to provide a TIN for a non-resident alien if they:
    • Doesn’t have income connected with the conduct of a U.S. trade or business
    • Does not file a federal tax return
    • Does not file a joint federal income tax return with a spouse who is a U.S. citizen or resident

Suspicious Transactions

• If illegal or fraudulent activity is suspected, fill out the form and mark it as a Suspicious Transaction.
• If marked as suspicious, do not tell the customer that a transaction form has been filed.

Civil and Criminal Penalties

• Civil Penalty (Negligence): $310 per return (dealer)
• Civil Penalty (Intentional disregard): The greater of $31,520 or the amount received (up to $126,000).
• Criminal Penalty (Criminal intent): Fines up to $100,000 for individuals ($500,000 for corporations) and/or imprisonment up to three years, plus prosecution costs.
• Penalties can be assessed against both the F&I practitioner and the customer for attempting to avoid filing Form 8300.

USA Patriot Act & OFAC

• The Office of Foreign Assets Control (OFAC) is a division of the Treasury Department that tracks potential terrorists and other foreign criminals.
• The Specially Designated Nationals (SDN) and Blocked Persons list is maintained by OFAC and constantly updated.
• Businesses/individuals cannot deal with any entity on the SDN list.
• Penalties for noncompliance could be a $5 million fine and/or up to 30 years in prison, or both.
• Check every customer against the SDN & Blocked Persons list regardless of transaction type or funding source.
• There is no defense for noncompliance with OFAC.
• The OFAC check should be completed at the time the deal is consummated – and on all parties – regardless of whether their name is on the RISC.

OFAC Potential “Hit”

• The customer’s name has matched to another name on the SDN or Blocked Persons List.
• First, ask out of wallet questions.
• If that doesn't provide clarity compare the information manually.
• Request additional information from the customer to differentiate them from the person listed on the SDN list:
  • Date of Birth
  • Address
  • Nationality
  • Place of Birth
• If only the name matches, print out the documents and include them in the deal jacket.

OFAC Exact Match

• If an exact match cannot be determined, OFAC recommends calling 1(800) 540-6322 for confirmation before blocking the transaction.
• If an exact match is confirmed:
• Do not deliver the vehicle.
• Notify OFAC in writing within 10 business days with supporting documentation.
• Secure and keep every transaction-related document on file for 5 years.

Do-Not-Call Rule

• States that you cannot contact anyone listed on do-not-call lists with an unsolicited sales pitch.
• Exceptions:
  • Contacting an interested consumer for 90 days from their inquiry or sharing of contact information.
  • Contacting a customer within 18 months from the date of purchase, lease, or last transaction.
• If a Customer Doesn't Want to be called again:
  • If the customer IS ON the state or national Do Not Call registry they cannot be contacted again.
  • If the customer IS NOT ON the state or national Do Not Call registry, the customer can be contacted after 60 months (5 years).

Customer Referral (Bird Dog) Program

• You cannot contact any "lead" acquired through a former customer without checking the prospective customer’s name against do-not-call lists.

Do-Not-Email Rule - CAN-SPAM Act

• The FTC categorizes emails by primary purpose:
  • Relationship emails: personal messages.
  • Transactional emails: facilitate transactions or update customers.
  • Commercial emails: advertise or promote vehicles/services.
• Only Commercial emails are regulated by the CAN-SPAM Act.

Do-Not-Email Rule requirements

• Don’t use a fraudulent “From” line which must be accurate.
• Don’t use fraudulent subject lines which must reflect message content.
• Identify the message as an ad (e.g., use "ADV" in all caps).
• Include the dealership’s valid physical postal address.
• Provide a clear explanation of how to opt-out (unsubscribe) from future emails.
• The unsubscribe link must remain active for 30 days.
• The sender must honor the unsubscribe request within 10 business days.

Rules for Cell Phones

• You must have prior written permission or opt-in from the cell phone owner to send any commercial message to a cell phone.