Under FACTA, what must financial institutions maintain to guard against identity theft?

• A. Private encryption keys.
• B. Publicly posted security audits.
• C. Internal codes for data access.
• D. Written identity theft prevention programs.

Answer: (D)

Under FACTA, financial institutions must maintain a written identity theft prevention program. This formal plan, tied to the Red Flags Rule, is designed to detect, prevent, and mitigate identity theft for consumer accounts. It requires the institution to identify potential red flags, specify procedures for responding to suspicious activity, assign responsibilities, train staff, and regularly update the program as risks evolve. The emphasis is on having a documented, systematic approach rather than relying on informal or ad hoc measures. Other options don’t fit because FACTA’s requirement centers on a formal, written program to guard against identity theft, not on encryption keys, public audits, or internal access codes.