Do the red flag regs apply to denied applications?

No. The FACT Act red flag regulations apply to “covered accounts”

Under the law, an “account” means a continuing relationship established by a person with a financial institution or creditor to obtain a product or service for personal, family, household or business purposes.

The term “covered account” means (i) an account that a financial institution or creditor offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, such as a credit card account, mortgage loan,automobile loan, checking account, savings account, etc.; and (ii) any other account that the financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers/members or to the safety and soundness of the financial institution or creditor from identity theft.

Since an application that is denied does not result in a continuing relationship it is not subject your ID theft prevention program. However, anytime you are handling personal information you must insure the safety of that information to avoid identity theft issues.

The Red Flag Tool Kit can assist you in drafting red flag policies, training your staff and monitoring account activity for identity theft issues.