FTC Red Flags Rule checklist preparation should be part of every dealership’s compliance routine if the store arranges or extends customer financing. Dealer Educator training emphasizes that dealers engaged in financing activity need a written Identity Theft Prevention Program designed to identify warning signs, detect them in real transactions, respond appropriately, and keep the program current. This article turns those requirements into a practical, audit-ready workflow for California retail dealers.
Why the Red Flags Rule matters in dealership operations
The FTC Red Flags Rule applies to certain creditors and financial institutions that maintain covered accounts, including businesses that extend or arrange credit in ways that create identity theft risk. The Federal Trade Commission explains that a written program must include reasonable policies and procedures to identify, detect, and respond to red flags, and to update the program as risks change. FTC Red Flags Rule Business Guidance
For dealerships, the risk is not theoretical. A fraudster may try to buy a vehicle using another person’s identity, submit inconsistent credit information, use suspicious documents, or pressure staff to rush delivery before verification is complete. A strong program protects consumers, lenders, and the dealership’s license reputation.
FTC Red Flags Rule checklist for dealers
Use this checklist to build or refresh your written Identity Theft Prevention Program. Keep the completed checklist, policy, training records, and review notes in a compliance file so management can show how the program is maintained.
| Checklist item | What to document |
| Confirm coverage | Identify whether the dealership is a covered creditor because it regularly arranges, extends, or participates in customer credit transactions that create covered accounts. |
| List dealership-specific red flags | Document warning signs found in credit applications, driver licenses, addresses, phone numbers, credit reports, down payments, trade-ins, online leads, and delivery requests. |
| Create detection steps | Write clear procedures for sales, BDC, and F&I staff to verify identity, compare information, review documents, and escalate suspicious activity. |
| Define responses | State what staff must do when a red flag appears, including pausing delivery, requesting additional verification, notifying a manager, declining the transaction, or contacting a financing source when appropriate. |
| Assign oversight | Name the senior manager or governing authority responsible for approving, administering, and updating the program. |
| Train staff | Keep records showing who was trained, when training occurred, and what topics were covered. |
| Review and update | Schedule periodic program reviews and update the policy when fraud patterns, technology, lenders, transaction types, or customer verification processes change. |
Step 1: Determine whether your dealership is a covered creditor
Start with a written coverage analysis. If your dealership offers financing, arranges retail installment sale contracts, sends credit applications to lenders, or otherwise participates in credit transactions, evaluate whether those activities create covered accounts under the FTC guidance. The point is to avoid guessing: document the financing activities your store performs and why the Red Flags Rule program applies. FTC Red Flags Rule Business Guidance
This step also helps with onboarding. New sales and F&I employees should understand that identity verification is not just a paperwork task; it is part of the dealership’s legal compliance system.
Step 2: Identify red flags that fit your transactions
A generic policy is weak. Your program should reflect how your dealership actually sells vehicles. Include red flags that may appear before, during, and after the credit transaction.
Common dealership red flags
- Identification that appears altered, inconsistent, expired, or difficult to match to the customer.
- Application details that conflict with the driver license, credit report, insurance documents, paystub, or trade-in paperwork.
- A customer who cannot reasonably explain address, employment, Social Security number, or contact information discrepancies.
- Requests to use unusual delivery locations, third-party payments, or rushed delivery before financing and identity checks are complete.
- Credit report alerts, fraud indicators, address mismatch information, or other identity-related notices from a consumer reporting agency.
- Online or phone leads where the person submitting the application avoids in-person verification or provides inconsistent contact information.
Do not treat this list as final. The FTC expects a program to be appropriate for the business, so your red flags should match your customers, financing sources, sales channels, and document workflow. 16 CFR Part 681
Step 3: Build detection into sales and F&I workflow
The best policy is easy for employees to follow during a busy deal. Create a written workflow that tells staff what to check and when to check it.
- At first contact, collect customer information consistently and avoid shortcuts for repeat, referral, or remote customers.
- Before submitting credit, compare the application with identification and other supporting documents.
- Before contracting, review credit-report indicators, lender stipulations, address history, and document consistency.
- Before delivery, confirm that unresolved red flags have been cleared by the assigned manager.
- After the sale, retain identity-verification notes according to your recordkeeping policy and privacy safeguards.
Because financing disclosures and credit documents are already sensitive, align this workflow with your existing F&I compliance process. Regulation Z governs consumer credit disclosures, including key finance terms for covered consumer credit transactions. CFPB Regulation Z
Step 4: Define clear responses when a red flag is detected
Your written program should remove uncertainty. Employees should not have to decide alone whether to continue a deal when identity theft indicators appear. Use response tiers so staff know what to do.
| Risk level | Example response |
| Low | Correct a simple clerical error, document the explanation, and continue only if the information is verified. |
| Moderate | Request additional identification or supporting documents, involve F&I management, and hold delivery until reviewed. |
| High | Stop the transaction, escalate to the designated compliance manager, notify the financing source when appropriate, and document the decision. |
Responses should be designed to prevent or reduce identity theft, which is a core requirement of the Red Flags Rule. FTC Red Flags Rule Business Guidance
Step 5: Assign governance and keep the program current
The Red Flags Rule is not a one-time form. Dealer Educator coursework highlights governance controls such as senior approval, oversight of implementation, staff training, and periodic updates. Put those controls in writing.
Audit-ready governance file
- Signed approval of the written Identity Theft Prevention Program by the owner, board, committee, or designated senior manager.
- Named program administrator and backup contact.
- Training roster for sales, BDC, accounting, title, and F&I personnel.
- Deal-jacket checklist showing identity verification and red-flag review steps.
- Escalation log for suspicious activity, including the issue, response, reviewer, and outcome.
- Periodic review notes showing policy updates, new red flags, lender feedback, or process changes.
Practical tips for California retail dealers
- Make it visible: Add red-flag checkpoints to your credit application, menu, contracting, and delivery procedures.
- Train beyond F&I: Sales, internet, reception, title, and accounting staff may see warning signs before the F&I manager does.
- Use consistent escalation: A suspicious deal should be reviewed the same way every time, regardless of vehicle price or salesperson.
- Protect customer data: Identity theft prevention works best when paired with careful handling of nonpublic customer information.
- Review real examples: Use anonymized past issues, lender stipulations, and document discrepancies as training scenarios.
Bottom line
A strong Red Flags Rule program is more than a binder on a shelf. It is a daily dealership process: know whether you are covered, identify the red flags that fit your business, train staff to detect them, require clear responses, and document management oversight. That combination supports consumer protection, lender confidence, and dealership compliance readiness.
