12 CFR §41.91 — Duties of card issuers regarding changes of address

occ-12cfr-41-91

12 CFR §41.91, Duties of card issuers regarding changes of address. The OCC's Identity Theft Red Flags rule (Subpart J of 12 CFR Part 41), for national banks, federal savings associations and federal branches and agencies of foreign banks.

This register: .xlsx .csv

Verbatim regulatory text (5)

Verbatim provisions from 12 CFR §41.91 — Duties of card issuers regarding changes of address — each quote is a verified substring of the regulator-published source snapshot, not retyped. Quoted for reference; this is not legal advice. The operational layer (P&P updates, prompts) lives in the regulation update kits.

12 CFR §41.91(a)

(a) Scope. This section applies to an issuer of a debit or credit card (card issuer) that is a national bank; a Federal savings association; a Federal branch or agency of a foreign bank; or an operating subsidiary of any of these institutions that is not a functionally regulated subsidiary within the meaning of section 5(c)(5) of the Bank Holding Company Act of 1956, as amended (12 U.S.C. 1844(c)(5)).

Source: 12 CFR §41.91(a) · source URL · snapshot 270bacb4af305010

12 CFR §41.91(b)

(b) Definitions. For purposes of this section: (1) Cardholder means a consumer who has been issued a credit or debit card. (2) Clear and conspicuous means reasonably understandable and designed to call attention to the nature and significance of the information presented. (3) Consumer means an individual.

Source: 12 CFR §41.91(b) · source URL · snapshot 270bacb4af305010

12 CFR §41.91(c)

(c) Address validation requirements. A card issuer must establish and implement reasonable policies and procedures to assess the validity of a change of address if it receives notification of a change of address for a consumer's debit or credit card account and, within a short period of time afterwards (during at least the first 30 days after it receives such notification), the card issuer receives a request for an additional or replacement card for the same account. Under these circumstances, the card issuer may not issue an additional or replacement card, until, in accordance with its reasonable policies and procedures and for the purpose of assessing the validity of the change of address, the card issuer: (1)(i) Notifies the cardholder of the request: (A) At the cardholder's former address; or (B) By any other means of communication that the card issuer and the cardholder have previously agreed to use; and (ii) Provides to the cardholder a reasonable means of promptly reporting incorrect address changes; or (2) Otherwise assesses the validity of the change of address in accordance with the policies and procedures the card issuer has established pursuant to § 41.90 of this part.

Source: 12 CFR §41.91(c) · source URL · snapshot 270bacb4af305010

12 CFR §41.91(d)

(d) Alternative timing of address validation. A card issuer may satisfy the requirements of paragraph (c) of this section if it validates an address pursuant to the methods in paragraph (c)(1) or (c)(2) of this section when it receives an address change notification, before it receives a request for an additional or replacement card.

Source: 12 CFR §41.91(d) · source URL · snapshot 270bacb4af305010

12 CFR §41.91(e)

(e) Form of notice. Any written or electronic notice that the card issuer provides under this paragraph must be clear and conspicuous and provided separately from its regular correspondence with the cardholder.

Source: 12 CFR §41.91(e) · source URL · snapshot 270bacb4af305010

Get this regulation in your AI window

Put the verbatim text and its effective date in front of your assistant, instead of whatever it remembers.

Add to Claude Add to ChatGPT

Add to Claude shows the one-time setup: paste one address, no account with us. Add to ChatGPT adds the free C4C app from ChatGPT’s app directory. Either way it’s free.

Get notified if this rule changes

One email when 12 CFR §41.91 — Duties of card issuers regarding changes of address changes: what changed, the new verbatim text, and the effective date. Nothing else.

Double opt-in: we send a confirmation link first. Following one section does not subscribe you to anything else. Privacy.

Source of record: https://claudeforcompliance.com/regs/occ-12cfr-41-91/ · register occ-12cfr-41-91 · verbatim, source-snapshotted regulator text from the Claude for Compliance corpus. To work from every register at once, download the corpus and follow the methodology.