I'm hoping someone can provide some guidance regarding the clearing of Red Flags, and the "proof" we are required to retain. There is no record retention requirement of the Red Flags rule to my knowledge, however, in FAQs released by the FDIC they indicate that institutions must be able to "demonstrate that they have complied with the requirements of the Red Flags [and Address Discrepancy] rules.

In demonstrating that we are complying with the requirements of the Red Flags rule do we need to simply show that we have detected and "cleared" a Red Flag, or do we need to specifically demonstrate "how" we cleared the Red Flags? Do our procedures alone demonstrate how we clear Red Flags, and is that enough for examiners?

Procedures that our institution has implemented requires notes to be entered regarding the method used to clear the red flags, but we are finding that notes do not always appear. They do, however, always show that a red flag has been cleared. If we are not providing these notes specifically outlining "how" the red flag was cleared will examiners presume that we have not actually cleared them? Thanks for the help!

In my experience, if my procedures say that notes will be made, my examiners and auditors will look for notes when they are testing transactions. If your procedures state a Red Flag is cleared when it is documented by a black checkmark next to "Red Flag cleared" at the bottom of a Loan Worksheet, then they will be looking for that box to be checked when a Red Flag is identified.

While that may satisfy an examiner or auditor procedure wise, I think the greater risk would be if you had a consumer complain that the Bank should have caught the Red Flag and didn't, and that check mark is all the documentation you have to support it was in fact cleared. I have learned that unless my lenders document today, they are not going remember tomorrow.